c57d267370cbbe5ae6961e6977a511558510a27e382c38424420c44f7bc3cd07 | Triage

Sharing

General

Target

edd14498921a2da98d8428ee5455db1d_JaffaCakes118
Size

189KB
Sample

240920-r33kzascnk
MD5

edd14498921a2da98d8428ee5455db1d
SHA1

00aadc74bc3752daac442c6af36b7ce52115cc82
SHA256

c57d267370cbbe5ae6961e6977a511558510a27e382c38424420c44f7bc3cd07
SHA512

4064feac22a27b7455f3b38ceab3fa3ccfd1b8dfc0745aceeb3b2db648272413451dd39a4eb6bbd8f52447a06e5515e469ca8cbb8c7c7112d10f88b143b869ec
SSDEEP

3072:QnQXFGsrclmO0cQJvPqTRNxIAt8FQ3hINepizl/vhk+j9ZjMVVND7QzQejE5mMBM:gQ1ldcqKTKgoiINepb+j9ZjMHND7QzQ0

Score

10^/10

discovery persistence upx

Malware Config

Targets

- Target
  
  edd14498921a2da98d8428ee5455db1d_JaffaCakes118
- Size
  
  189KB
- MD5
  
  edd14498921a2da98d8428ee5455db1d
- SHA1
  
  00aadc74bc3752daac442c6af36b7ce52115cc82
- SHA256
  
  c57d267370cbbe5ae6961e6977a511558510a27e382c38424420c44f7bc3cd07
- SHA512
  
  4064feac22a27b7455f3b38ceab3fa3ccfd1b8dfc0745aceeb3b2db648272413451dd39a4eb6bbd8f52447a06e5515e469ca8cbb8c7c7112d10f88b143b869ec
- SSDEEP
  
  3072:QnQXFGsrclmO0cQJvPqTRNxIAt8FQ3hINepizl/vhk+j9ZjMVVND7QzQejE5mMBM:gQ1ldcqKTKgoiINepb+j9ZjMHND7QzQ0
Score

10^/10

discovery persistence upx
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceupx

behavioral2