Overview

overview

9

Static

static

3

97e8516d8f...18.exe

windows7-x64

9

97e8516d8f...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97e8516d8f563f9116c460b223e1c8a7_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240605-mswbpadd2z

  • MD5

    97e8516d8f563f9116c460b223e1c8a7

  • SHA1

    b041d889e23acd1632d428d49b63a16a6cd7890a

  • SHA256

    a8031971999f9b8332c545a15a0b9c0cb5eccc62ccf11d11ce280bee08c797df

  • SHA512

    d555e59a8f3833878447f125353340ed1f97963bca59cbb07ceea11a2b0a0d78ccce455179e67c360e9988126d52e2a3d4909503e32c27199d4c919339681ca6

  • SSDEEP

    24576:VQAperrOUj6k7ZqC301t/tJv0OWF0crmRMJE5+nahx:VQQk7ZxgBtFYuAmRMW5+nC

Score
9/10
collectionpersistence

Malware Config

Targets

    • Target

      97e8516d8f563f9116c460b223e1c8a7_JaffaCakes118

    • Size

      1.0MB

    • MD5

      97e8516d8f563f9116c460b223e1c8a7

    • SHA1

      b041d889e23acd1632d428d49b63a16a6cd7890a

    • SHA256

      a8031971999f9b8332c545a15a0b9c0cb5eccc62ccf11d11ce280bee08c797df

    • SHA512

      d555e59a8f3833878447f125353340ed1f97963bca59cbb07ceea11a2b0a0d78ccce455179e67c360e9988126d52e2a3d4909503e32c27199d4c919339681ca6

    • SSDEEP

      24576:VQAperrOUj6k7ZqC301t/tJv0OWF0crmRMJE5+nahx:VQQk7ZxgBtFYuAmRMW5+nC

    Score
    9/10
    collectionpersistence

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks