26ea7814f5888b85d90ce32ca2bccf0a70c2b1370c4acd022ec67e339829931b | Triage

Sharing

General

Target

01a8fb9e746dd2d600ac3c1c26b7e4cb_JaffaCakes118
Size

101KB
Sample

240930-q45w2ssfmh
MD5

01a8fb9e746dd2d600ac3c1c26b7e4cb
SHA1

41f1a6a9a29056f74516274d3f0d6d9907e23da4
SHA256

26ea7814f5888b85d90ce32ca2bccf0a70c2b1370c4acd022ec67e339829931b
SHA512

c47568b33d8c4ca6e3cfa5bb03c63e0cdd7c8fb479e3c115e484814107b76aaf889c690d8299743e20505f8e24aaa109ac123f892b8b9e2a6e873a9240ab0cc8
SSDEEP

1536:DfJEDJjoDTeuFAW49rWT7BB4o3PTZ//jUCNigdBtoqXyNHBxO0:DfJqZdW49rWT7BB4o3VXNigdnyNHBxO

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  01a8fb9e746dd2d600ac3c1c26b7e4cb_JaffaCakes118
- Size
  
  101KB
- MD5
  
  01a8fb9e746dd2d600ac3c1c26b7e4cb
- SHA1
  
  41f1a6a9a29056f74516274d3f0d6d9907e23da4
- SHA256
  
  26ea7814f5888b85d90ce32ca2bccf0a70c2b1370c4acd022ec67e339829931b
- SHA512
  
  c47568b33d8c4ca6e3cfa5bb03c63e0cdd7c8fb479e3c115e484814107b76aaf889c690d8299743e20505f8e24aaa109ac123f892b8b9e2a6e873a9240ab0cc8
- SSDEEP
  
  1536:DfJEDJjoDTeuFAW49rWT7BB4o3PTZ//jUCNigdBtoqXyNHBxO0:DfJqZdW49rWT7BB4o3VXNigdnyNHBxO
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2