Overview

overview

8

Static

static

3

047a9bf43f...18.exe

windows7-x64

8

047a9bf43f...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    047a9bf43f7fa71e84e8cf42e32fa62a_JaffaCakes118

  • Size

    194KB

  • Sample

    240620-krzavashlk

  • MD5

    047a9bf43f7fa71e84e8cf42e32fa62a

  • SHA1

    b7839b2fa7190d129a741b12bfcb8ee37fec8626

  • SHA256

    608593fcf6d4c4388f0b8dd2e6e127b101823b688301b1fbdaf49b8c0f9b4ec0

  • SHA512

    83db3717907252b69f69e3bed19daa462e5a30484a7b8d9ba7acdcc372da1724de520a112c71176276360a7ab3a332e670d0f680214f93cfda7927c98d3d1234

  • SSDEEP

    6144:zVpLfZcN/uOzP2N/L7RI++KOw9puou2DY:xOz2P0KxDDY

Score
8/10
evasionpersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      047a9bf43f7fa71e84e8cf42e32fa62a_JaffaCakes118

    • Size

      194KB

    • MD5

      047a9bf43f7fa71e84e8cf42e32fa62a

    • SHA1

      b7839b2fa7190d129a741b12bfcb8ee37fec8626

    • SHA256

      608593fcf6d4c4388f0b8dd2e6e127b101823b688301b1fbdaf49b8c0f9b4ec0

    • SHA512

      83db3717907252b69f69e3bed19daa462e5a30484a7b8d9ba7acdcc372da1724de520a112c71176276360a7ab3a332e670d0f680214f93cfda7927c98d3d1234

    • SSDEEP

      6144:zVpLfZcN/uOzP2N/L7RI++KOw9puou2DY:xOz2P0KxDDY

    Score
    8/10
    evasionpersistenceprivilege_escalationspywarestealer

    • Modifies Windows Firewall

      evasion

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials in Registry

1
T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks