e251006c1a88dca920c524d493ec16514fb393e8f33c3682948cebba69ab4998 | Triage

Sharing

General

Target

267125977cb2e5a1f94c21a9a9943b79_JaffaCakes118
Size

938KB
Sample

241008-2fg1vstemp
MD5

267125977cb2e5a1f94c21a9a9943b79
SHA1

90870f2e0b259cad5c9a40988d3882cfde69d21c
SHA256

e251006c1a88dca920c524d493ec16514fb393e8f33c3682948cebba69ab4998
SHA512

bf4dec17414a49f8638ba8ffe45fcc62d50b83af2044f3ffd9a5d1cced37d8afda1e0e52ff10c696a460573c423ff78252fa586275057f532b6ff312da55c3b1
SSDEEP

24576:yPfPf3V1DmHJLJJltyd7nFrA4H1z9pv/20M:yPfPf3+vOdhrNZv/0

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  267125977cb2e5a1f94c21a9a9943b79_JaffaCakes118
- Size
  
  938KB
- MD5
  
  267125977cb2e5a1f94c21a9a9943b79
- SHA1
  
  90870f2e0b259cad5c9a40988d3882cfde69d21c
- SHA256
  
  e251006c1a88dca920c524d493ec16514fb393e8f33c3682948cebba69ab4998
- SHA512
  
  bf4dec17414a49f8638ba8ffe45fcc62d50b83af2044f3ffd9a5d1cced37d8afda1e0e52ff10c696a460573c423ff78252fa586275057f532b6ff312da55c3b1
- SSDEEP
  
  24576:yPfPf3V1DmHJLJJltyd7nFrA4H1z9pv/20M:yPfPf3+vOdhrNZv/0
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence