24b799dfe6978403981bca2ce5211b452b3b554213e9a7200cb33609111d2274 | Triage

Sharing

General

Target

0a13a956e4b398aac91c736715e24030_JaffaCakes118
Size

104KB
Sample

241002-lv538stelf
MD5

0a13a956e4b398aac91c736715e24030
SHA1

26910750d7856797555b97f0733d073094c3c6d3
SHA256

24b799dfe6978403981bca2ce5211b452b3b554213e9a7200cb33609111d2274
SHA512

b350eae3eb66fd5a9a9ede40285287e30b4683333a4d81e9e179c946c93afd5d96d4111f990cea3f1b5b02b9bfbd6c148995a039560f3b12f8160552dcfece5d
SSDEEP

3072:MDjabtcLayLXD6riZmW4NaBZdZP+gnza:Myb4KNaBZWr

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  0a13a956e4b398aac91c736715e24030_JaffaCakes118
- Size
  
  104KB
- MD5
  
  0a13a956e4b398aac91c736715e24030
- SHA1
  
  26910750d7856797555b97f0733d073094c3c6d3
- SHA256
  
  24b799dfe6978403981bca2ce5211b452b3b554213e9a7200cb33609111d2274
- SHA512
  
  b350eae3eb66fd5a9a9ede40285287e30b4683333a4d81e9e179c946c93afd5d96d4111f990cea3f1b5b02b9bfbd6c148995a039560f3b12f8160552dcfece5d
- SSDEEP
  
  3072:MDjabtcLayLXD6riZmW4NaBZdZP+gnza:Myb4KNaBZWr
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2