Overview

overview

7

Static

static

3

ea531aaff6...18.exe

windows7-x64

7

ea531aaff6...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/$S...4_.exe

windows7-x64

7

$SYSDIR/$S...4_.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$TEMP/$_8_.dll

windows7-x64

6

$TEMP/$_8_.dll

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118
  • Size 194KB
  • Sample240409-s2zclaee3t
  • SHA256 7bfa96ea7e2f70c3fdee3ce490a283b82a02e8e2f4ca724fc98cf70f90d8b92f
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target
      ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118
    • Size 194KB
    • SHA256 7bfa96ea7e2f70c3fdee3ce490a283b82a02e8e2f4ca724fc98cf70f90d8b92f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    adwarediscoverypersistencestealer

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 10KB
    • SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      $SYSDIR/$SYSDIR/$_14_.exe
    • Size 46KB
    • SHA256 0edcfc77ab368f894127d802e26d27f7cc1eb275c7e9f18fea4e6ee748abccf4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5behavioral6
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 2ca5590c85cc31285b83bbe569755d909d91b559db2d6ce3bca2fcc075225364
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 10KB
    • SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral10behavioral9
    • Target
      $TEMP/$_8_.dll
    • Size 381KB
    • SHA256 13e04a3fc70b4215feb1c4d01d74a1084d2248caa6196ff4ba91d196095c90c1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    adwarepersistencestealer

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks