29b2982ffef391207b6277098c167be141afe62ea5670d3e727f8f51db47968a | Triage

Sharing

General

Target

eee31016f807bf60bcf991280994ffcd_JaffaCakes118
Size

436KB
Sample

240921-cqlpcs1akk
MD5

eee31016f807bf60bcf991280994ffcd
SHA1

8faf1a9de1aec8d1b0f7875abcf14ac39af7a6e9
SHA256

29b2982ffef391207b6277098c167be141afe62ea5670d3e727f8f51db47968a
SHA512

a6341ec12a9ba53d4ebf7c3334a5b84293d5be3a052d36d11390d67232efe01a489f193d60fbf1e544aa7754cefa2ea81843b00355661d11cc0359f82d499cfd
SSDEEP

12288:7MSU4joci8M6PW1GVFeFd60DFUyhewYM:ASUCpM2W1Gvgmyewv

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  eee31016f807bf60bcf991280994ffcd_JaffaCakes118
- Size
  
  436KB
- MD5
  
  eee31016f807bf60bcf991280994ffcd
- SHA1
  
  8faf1a9de1aec8d1b0f7875abcf14ac39af7a6e9
- SHA256
  
  29b2982ffef391207b6277098c167be141afe62ea5670d3e727f8f51db47968a
- SHA512
  
  a6341ec12a9ba53d4ebf7c3334a5b84293d5be3a052d36d11390d67232efe01a489f193d60fbf1e544aa7754cefa2ea81843b00355661d11cc0359f82d499cfd
- SSDEEP
  
  12288:7MSU4joci8M6PW1GVFeFd60DFUyhewYM:ASUCpM2W1Gvgmyewv
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence