3313b765b69555465d780c6a446ad9254c8f69d978553ea960076223f7963a97 | Triage

Sharing

General

Target

e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118
Size

388KB
Sample

240918-x5kqtsyfph
MD5

e9d241d83d6df24d69f9c72fad13cc9f
SHA1

2607b9d33f9c1425b2b0480c0f9c4e591f6ad5e7
SHA256

3313b765b69555465d780c6a446ad9254c8f69d978553ea960076223f7963a97
SHA512

ce234473ce0071e205c32d8b5cc97b6607a7cbe9d54bddb4b1a131ce63878145b3b3ae97f33bfab28c56307d8ad9f4ac772616e1ba5fe6a468578d148335ef10
SSDEEP

1536:Tkf1zwQVg/8WuREUlOQnF7TkkYSDY6ep5f1zwQVgvXg6Y+:Y1zwL/8WuREcnFEkYSYpJ1zwLvX

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118
- Size
  
  388KB
- MD5
  
  e9d241d83d6df24d69f9c72fad13cc9f
- SHA1
  
  2607b9d33f9c1425b2b0480c0f9c4e591f6ad5e7
- SHA256
  
  3313b765b69555465d780c6a446ad9254c8f69d978553ea960076223f7963a97
- SHA512
  
  ce234473ce0071e205c32d8b5cc97b6607a7cbe9d54bddb4b1a131ce63878145b3b3ae97f33bfab28c56307d8ad9f4ac772616e1ba5fe6a468578d148335ef10
- SSDEEP
  
  1536:Tkf1zwQVg/8WuREUlOQnF7TkkYSDY6ep5f1zwQVgvXg6Y+:Y1zwL/8WuREcnFEkYSYpJ1zwLvX
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence