0cbdcf40ccb1989c12c9e85497d539a6acf2eea2a0101dcc23d2c732ccb4a505 | Triage

Sharing

General

Target

fec9720f629c39db1a422a12ac1aea85_JaffaCakes118
Size

285KB
Sample

240929-sj9qlssemh
MD5

fec9720f629c39db1a422a12ac1aea85
SHA1

f1e818745ad70a89db0a11f4eb969d7e4bc1e867
SHA256

0cbdcf40ccb1989c12c9e85497d539a6acf2eea2a0101dcc23d2c732ccb4a505
SHA512

187aecdf7c0195f9e6dbc5c8956de8ee45124d14c063ebe48cb98c25dbc83a0bd3125d76d98403af97dd37261d91808c49657f952a63aa26006cb0e624c0c616
SSDEEP

6144:sKuzbaLaCdOn1KwVCUyP0Rr7qC7JcvhIidbZzS1T0d5fF4:sBPaLzupwIrPCvtZawF4

Score

10^/10

defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  fec9720f629c39db1a422a12ac1aea85_JaffaCakes118
- Size
  
  285KB
- MD5
  
  fec9720f629c39db1a422a12ac1aea85
- SHA1
  
  f1e818745ad70a89db0a11f4eb969d7e4bc1e867
- SHA256
  
  0cbdcf40ccb1989c12c9e85497d539a6acf2eea2a0101dcc23d2c732ccb4a505
- SHA512
  
  187aecdf7c0195f9e6dbc5c8956de8ee45124d14c063ebe48cb98c25dbc83a0bd3125d76d98403af97dd37261d91808c49657f952a63aa26006cb0e624c0c616
- SSDEEP
  
  6144:sKuzbaLaCdOn1KwVCUyP0Rr7qC7JcvhIidbZzS1T0d5fF4:sBPaLzupwIrPCvtZawF4
Score

10^/10

defense_evasion discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Subvert Trust Controls

SIP and Trust Provider Hijacking

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence