ab61c5a85d186e9fad20f6628eb984d7803e717dbc4020385c53afb4a6c106c1 | Triage

Sharing

General

Target

ef1ef844362a2b2f99d20f43a0ca4371_JaffaCakes118
Size

82KB
Sample

240921-fsgd7swemd
MD5

ef1ef844362a2b2f99d20f43a0ca4371
SHA1

c432c7d6d148f180cc95023d32bace11d8f18bbf
SHA256

ab61c5a85d186e9fad20f6628eb984d7803e717dbc4020385c53afb4a6c106c1
SHA512

71a3720de15cdc36a4996188f52b3f9d647121852a7b06deed24f7db2c7c5afa02a442b89b0eb0b746043067429f1cf984e610b341c9af389814ded7f1d7b461
SSDEEP

768:D1lVVVLHHHlVV9PldausDOIj49UIYyV/TIWNV1MA9PU5DHHVMqgVP8ySuRgVWuKH:dBO4V/Em1Mgo1MqO0NWILUwHPLaDB

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  ef1ef844362a2b2f99d20f43a0ca4371_JaffaCakes118
- Size
  
  82KB
- MD5
  
  ef1ef844362a2b2f99d20f43a0ca4371
- SHA1
  
  c432c7d6d148f180cc95023d32bace11d8f18bbf
- SHA256
  
  ab61c5a85d186e9fad20f6628eb984d7803e717dbc4020385c53afb4a6c106c1
- SHA512
  
  71a3720de15cdc36a4996188f52b3f9d647121852a7b06deed24f7db2c7c5afa02a442b89b0eb0b746043067429f1cf984e610b341c9af389814ded7f1d7b461
- SSDEEP
  
  768:D1lVVVLHHHlVV9PldausDOIj49UIYyV/TIWNV1MA9PU5DHHVMqgVP8ySuRgVWuKH:dBO4V/Em1Mgo1MqO0NWILUwHPLaDB
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2