General

  • Target

    15ff78833e82a807832888b36f92adce_JaffaCakes118

  • Size

    295KB

  • Sample

    240627-plsnbstdlr

  • MD5

    15ff78833e82a807832888b36f92adce

  • SHA1

    22e5b6908cbef2aea93d9082cd3019c58c2bbfca

  • SHA256

    b7f9b52adb5608993ac5e4767e6d524a7fca53286671774be15a9bddbe26c201

  • SHA512

    3afdb215f65ce429360442e4e45f2394725aa04e1e518ddaf472d7bb4379511cca605945d5ec89a4aac1d139c90e1346fb83c8c1f7fd8641e62701b32833778f

  • SSDEEP

    6144:bU867gbI4HbQDQdoAfxRH7JmOD6Ta6wuxGigJ5ObvMmOsvPTbZ:bHs4H4UzfxRVmOIa+xBgJ50v39

Malware Config

Targets

    • Target

      15ff78833e82a807832888b36f92adce_JaffaCakes118

    • Size

      295KB

    • MD5

      15ff78833e82a807832888b36f92adce

    • SHA1

      22e5b6908cbef2aea93d9082cd3019c58c2bbfca

    • SHA256

      b7f9b52adb5608993ac5e4767e6d524a7fca53286671774be15a9bddbe26c201

    • SHA512

      3afdb215f65ce429360442e4e45f2394725aa04e1e518ddaf472d7bb4379511cca605945d5ec89a4aac1d139c90e1346fb83c8c1f7fd8641e62701b32833778f

    • SSDEEP

      6144:bU867gbI4HbQDQdoAfxRH7JmOD6Ta6wuxGigJ5ObvMmOsvPTbZ:bHs4H4UzfxRVmOIa+xBgJ50v39

    • Modifies security service

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Disables taskbar notifications via registry modification

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks