General

  • Target

    16b5396f5c0d26c98d78837fe952d328_JaffaCakes118

  • Size

    273KB

  • Sample

    240627-t28rpsscpp

  • MD5

    16b5396f5c0d26c98d78837fe952d328

  • SHA1

    3c2c4e5b66051e5b6efd89ade7c9c640191500b1

  • SHA256

    66399b76f5c2f0b1dcb135c48da43ec0f1aa264ced93e7bd7414c68c2a9ec8da

  • SHA512

    ba228e43ef978b68362dc42697db70426d63760d5c518dadc5a7008562bf8b7f0d4896bba73d2ae1ac15f8d8775937b333dc36cdc58a7c196ec7a799ecb4984e

  • SSDEEP

    6144:i1g47EQhrEhSp97e+01xaLygbqHwxj6XnJmONv5VUKGbvmrR0z:ii4vp97N01C0ZmONrag0z

Malware Config

Targets

    • Target

      16b5396f5c0d26c98d78837fe952d328_JaffaCakes118

    • Size

      273KB

    • MD5

      16b5396f5c0d26c98d78837fe952d328

    • SHA1

      3c2c4e5b66051e5b6efd89ade7c9c640191500b1

    • SHA256

      66399b76f5c2f0b1dcb135c48da43ec0f1aa264ced93e7bd7414c68c2a9ec8da

    • SHA512

      ba228e43ef978b68362dc42697db70426d63760d5c518dadc5a7008562bf8b7f0d4896bba73d2ae1ac15f8d8775937b333dc36cdc58a7c196ec7a799ecb4984e

    • SSDEEP

      6144:i1g47EQhrEhSp97e+01xaLygbqHwxj6XnJmONv5VUKGbvmrR0z:ii4vp97N01C0ZmONrag0z

    • Modifies security service

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Disables taskbar notifications via registry modification

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks