5d7183052f3d7db0ba66ea0b14610a3c5ef5def33f56924b2245e9da3977bc80 | Triage

Sharing

General

Target

eab6a28995e90af25717324836737614_JaffaCakes118
Size

86KB
Sample

240919-gpcghsthql
MD5

eab6a28995e90af25717324836737614
SHA1

de9839233a75d19ad359d0bd879f90d32ccbe310
SHA256

5d7183052f3d7db0ba66ea0b14610a3c5ef5def33f56924b2245e9da3977bc80
SHA512

3526b61f3ecedaee1a8870622bd19233fc52f0d6c2474e9dfc45022b808a0cbef06c51c9262f2b5c3a44858d8f14973fa8adeed4a260d02b7bbff0a1a6832ae4
SSDEEP

1536:D9gZKbuAOaQBUJSgI+Kc9/86z+mQynLOn2VeUEWFqDmwzUG98kE:nb3OaQBUSAzdQEd0UEWB5

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  eab6a28995e90af25717324836737614_JaffaCakes118
- Size
  
  86KB
- MD5
  
  eab6a28995e90af25717324836737614
- SHA1
  
  de9839233a75d19ad359d0bd879f90d32ccbe310
- SHA256
  
  5d7183052f3d7db0ba66ea0b14610a3c5ef5def33f56924b2245e9da3977bc80
- SHA512
  
  3526b61f3ecedaee1a8870622bd19233fc52f0d6c2474e9dfc45022b808a0cbef06c51c9262f2b5c3a44858d8f14973fa8adeed4a260d02b7bbff0a1a6832ae4
- SSDEEP
  
  1536:D9gZKbuAOaQBUJSgI+Kc9/86z+mQynLOn2VeUEWFqDmwzUG98kE:nb3OaQBUSAzdQEd0UEWB5
Score

7^/10

persistence privilege_escalation discovery
- Loads dropped DLL
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Authentication Package

Privilege Escalation

Boot or Logon Autostart Execution

Authentication Package

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation