General

  • Target

    f0f4590178c4a113403f4443208baab0_JaffaCakes118

  • Size

    212KB

  • Sample

    240415-nmyqasff4x

  • MD5

    f0f4590178c4a113403f4443208baab0

  • SHA1

    8bad13e78ed5c1af8c53613e5a9d51dbecdcfb35

  • SHA256

    0dac8dc377514354055690218d20c710c00359792716f2d4dc10d53397281b67

  • SHA512

    3a2eeba055b4534001266b24370042649d7d95b98bd81fb253975d3ddda21c059152e3d950e16be2e1751f1d46eb1b2cc0e9dad0a5847b561a82e63581b79e1c

  • SSDEEP

    3072:PeLeGxcQ/1oCCmfiGvn41a6D2fgh13gj78nd7axwRm44SX4L:2LeGxcQ/1VCmfiGv41a5EnndOagSIL

Malware Config

Targets

    • Target

      f0f4590178c4a113403f4443208baab0_JaffaCakes118

    • Size

      212KB

    • MD5

      f0f4590178c4a113403f4443208baab0

    • SHA1

      8bad13e78ed5c1af8c53613e5a9d51dbecdcfb35

    • SHA256

      0dac8dc377514354055690218d20c710c00359792716f2d4dc10d53397281b67

    • SHA512

      3a2eeba055b4534001266b24370042649d7d95b98bd81fb253975d3ddda21c059152e3d950e16be2e1751f1d46eb1b2cc0e9dad0a5847b561a82e63581b79e1c

    • SSDEEP

      3072:PeLeGxcQ/1oCCmfiGvn41a6D2fgh13gj78nd7axwRm44SX4L:2LeGxcQ/1VCmfiGv41a5EnndOagSIL

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks