6cbb653a59a6331889e25db12e52502526f32f85bb49a38bf69dd7f507e66212 | Triage

Sharing

General

Target

eec53049ea776e7110f52d3022a32af4_JaffaCakes118
Size

251KB
Sample

240921-bbbp6sxfpm
MD5

eec53049ea776e7110f52d3022a32af4
SHA1

bf2f55ae94eee0b44957e07406e719f4337778c6
SHA256

6cbb653a59a6331889e25db12e52502526f32f85bb49a38bf69dd7f507e66212
SHA512

38a8b1c722c7c6ddb8476c27cac8a59b09f55cf689fa02132b5f3afbf7c4355056d8702385347857b74b348ce096f11942757279ec208d81a07ccc242b109a2f
SSDEEP

6144:7WEc4VrT48FPV1Avvt+j+P2xIe9jsLexZPkLDAr+:7WirT4yPV1Avvt+6KjsLeTcLC+

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  eec53049ea776e7110f52d3022a32af4_JaffaCakes118
- Size
  
  251KB
- MD5
  
  eec53049ea776e7110f52d3022a32af4
- SHA1
  
  bf2f55ae94eee0b44957e07406e719f4337778c6
- SHA256
  
  6cbb653a59a6331889e25db12e52502526f32f85bb49a38bf69dd7f507e66212
- SHA512
  
  38a8b1c722c7c6ddb8476c27cac8a59b09f55cf689fa02132b5f3afbf7c4355056d8702385347857b74b348ce096f11942757279ec208d81a07ccc242b109a2f
- SSDEEP
  
  6144:7WEc4VrT48FPV1Avvt+j+P2xIe9jsLexZPkLDAr+:7WirT4yPV1Avvt+6KjsLeTcLC+
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2