e1ad1cd87c70499a493709cf6cd4614931c04468c1cf72c08753ae173a77585d | Triage

Sharing

General

Target

129300697db5a920788f446e66c5fda0_JaffaCakes118
Size

104KB
Sample

241004-kbs4wsxhnh
MD5

129300697db5a920788f446e66c5fda0
SHA1

d7186e160c2b35546744d3306f7f5923bdd75f23
SHA256

e1ad1cd87c70499a493709cf6cd4614931c04468c1cf72c08753ae173a77585d
SHA512

7167961c33cb84e0e7bbfb2b4f8b58aeb28bfb407a2385f9f9b6f27665da10f5a863707ae87e5ca8fa0f8d6dc6d6746822c02d8857955fbf978a3a1f2a13e4bb
SSDEEP

1536:ZXiwshheUeactU+cWMvmdPQsjVxos7X+qhxB6UTeT1QzKwa+LKzBvcy6R:YwP1d/cW7jVmo+qx6USJQedvc1

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  129300697db5a920788f446e66c5fda0_JaffaCakes118
- Size
  
  104KB
- MD5
  
  129300697db5a920788f446e66c5fda0
- SHA1
  
  d7186e160c2b35546744d3306f7f5923bdd75f23
- SHA256
  
  e1ad1cd87c70499a493709cf6cd4614931c04468c1cf72c08753ae173a77585d
- SHA512
  
  7167961c33cb84e0e7bbfb2b4f8b58aeb28bfb407a2385f9f9b6f27665da10f5a863707ae87e5ca8fa0f8d6dc6d6746822c02d8857955fbf978a3a1f2a13e4bb
- SSDEEP
  
  1536:ZXiwshheUeactU+cWMvmdPQsjVxos7X+qhxB6UTeT1QzKwa+LKzBvcy6R:YwP1d/cW7jVmo+qx6USJQedvc1
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2