General

  • Target

    716482c09d8eae95e6e10fdb17c62e1b_JaffaCakes118

  • Size

    212KB

  • Sample

    240525-keklxsbf4y

  • MD5

    716482c09d8eae95e6e10fdb17c62e1b

  • SHA1

    3c3958b68111504bae09be7e0e159495f5cc24e6

  • SHA256

    33e6ac6621e3c458711c64a439dd8d5a2ab90bbc256e34823cc8ff7fd9ab7610

  • SHA512

    6478b2265b68fed56b9a6ad8f8de33d41312069283197423103bc81d175afdc4947b797b03e3f483c564166dd213f56c7468880a45307db63522cd6ee613fd4f

  • SSDEEP

    3072:mmDvSy93/kZq3eGNEL3nC1sRj79n7maxwRm44SX4R:mmDvh9vkZbGNEHDn7bagSIR

Malware Config

Targets

    • Target

      716482c09d8eae95e6e10fdb17c62e1b_JaffaCakes118

    • Size

      212KB

    • MD5

      716482c09d8eae95e6e10fdb17c62e1b

    • SHA1

      3c3958b68111504bae09be7e0e159495f5cc24e6

    • SHA256

      33e6ac6621e3c458711c64a439dd8d5a2ab90bbc256e34823cc8ff7fd9ab7610

    • SHA512

      6478b2265b68fed56b9a6ad8f8de33d41312069283197423103bc81d175afdc4947b797b03e3f483c564166dd213f56c7468880a45307db63522cd6ee613fd4f

    • SSDEEP

      3072:mmDvSy93/kZq3eGNEL3nC1sRj79n7maxwRm44SX4R:mmDvh9vkZbGNEHDn7bagSIR

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Adds Run key to start application

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks