0a0dd626cf0198bf3c0ab3e02a69c457d03c11694a45d0867bdff7db7804c0e2 | Triage

Sharing

General

Target

2d9e2dafe65b5503fbce184872aa87fb_JaffaCakes118
Size

21KB
Sample

241009-jy1a2swhjn
MD5

2d9e2dafe65b5503fbce184872aa87fb
SHA1

6f5cf4c80cc86bff3f78ef7de9b8809a5d72d0d9
SHA256

0a0dd626cf0198bf3c0ab3e02a69c457d03c11694a45d0867bdff7db7804c0e2
SHA512

74326c44bf36288b3eda201ac2f0317202df4e5f61a62abcb37cba5633a9703ad00a580a8e33a52e449021142f4c26be34aa019a09221ceb667f208834c99f73
SSDEEP

384:oBQdvnWVAWMc+WZmV0KBKHEdrZgo6cnxJ7RE2mu1DU6EpE:NWVAW3A0u4kH6aJ7O7u1Y6Ep

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  2d9e2dafe65b5503fbce184872aa87fb_JaffaCakes118
- Size
  
  21KB
- MD5
  
  2d9e2dafe65b5503fbce184872aa87fb
- SHA1
  
  6f5cf4c80cc86bff3f78ef7de9b8809a5d72d0d9
- SHA256
  
  0a0dd626cf0198bf3c0ab3e02a69c457d03c11694a45d0867bdff7db7804c0e2
- SHA512
  
  74326c44bf36288b3eda201ac2f0317202df4e5f61a62abcb37cba5633a9703ad00a580a8e33a52e449021142f4c26be34aa019a09221ceb667f208834c99f73
- SSDEEP
  
  384:oBQdvnWVAWMc+WZmV0KBKHEdrZgo6cnxJ7RE2mu1DU6EpE:NWVAW3A0u4kH6aJ7O7u1Y6Ep
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence