e89e710b2f8f5eb795dbecd05a082cd61ca8f73f71e85a043f3c9e8ee261acdf | Triage

Sharing

General

Target

00baab801089d2ab0553004f155b9c3f_JaffaCakes118
Size

72KB
Sample

240930-lxf7wsyejp
MD5

00baab801089d2ab0553004f155b9c3f
SHA1

41d0cb1aeb5790e96faf63a02c54c3b3f628d3a6
SHA256

e89e710b2f8f5eb795dbecd05a082cd61ca8f73f71e85a043f3c9e8ee261acdf
SHA512

b1952e355ee933982b5e44cbed894acbe84714f359545bbe07a7089c4479299c39cbf6ea0ad45c5e2a739e0f6b05a27b0ccdc8175e897a94c9fed9bd728b629f
SSDEEP

1536:zlbVF9Uvmhlc4lkro/vPptfECOPilWurRu+LefUVbyZnrhT:xbV9hlc4eroPPsH2+ibANT

Score

6^/10

discovery persistence

Malware Config

Targets

- Target
  
  00baab801089d2ab0553004f155b9c3f_JaffaCakes118
- Size
  
  72KB
- MD5
  
  00baab801089d2ab0553004f155b9c3f
- SHA1
  
  41d0cb1aeb5790e96faf63a02c54c3b3f628d3a6
- SHA256
  
  e89e710b2f8f5eb795dbecd05a082cd61ca8f73f71e85a043f3c9e8ee261acdf
- SHA512
  
  b1952e355ee933982b5e44cbed894acbe84714f359545bbe07a7089c4479299c39cbf6ea0ad45c5e2a739e0f6b05a27b0ccdc8175e897a94c9fed9bd728b629f
- SSDEEP
  
  1536:zlbVF9Uvmhlc4lkro/vPptfECOPilWurRu+LefUVbyZnrhT:xbV9hlc4eroPPsH2+ibANT
Score

6^/10

discovery persistence
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence