f2bb4841e6b19d120f11b076774ad4700e7010c1f4d4bb8fb1ee8b834183c90b | Triage

Sharing

General

Target

270e6c70f479ff5b2aef6e5422908ff1_JaffaCakes118
Size

1.5MB
Sample

240705-xpharswcjf
MD5

270e6c70f479ff5b2aef6e5422908ff1
SHA1

23355063c4415fa24f115c57c9fb81ac6c0e4183
SHA256

f2bb4841e6b19d120f11b076774ad4700e7010c1f4d4bb8fb1ee8b834183c90b
SHA512

789a5760559fbc2757d8382fb31392b640673be211cee93c4bcb9a95a465b05b222f3fe14abb72947a4984193019065843825ad5a807597fc5f86281844d2acf
SSDEEP

24576:mfOyotfeirQIpaFaH1v1ydiGhuGxxjk3pppn8LbYt4/9WeQN7of0bDgq2yjUs2U2:mGnpbaFc+iGTk3pp+bF8HbUfyj

Score

7^/10

adware stealer

Malware Config

Targets

- Target
  
  270e6c70f479ff5b2aef6e5422908ff1_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  270e6c70f479ff5b2aef6e5422908ff1
- SHA1
  
  23355063c4415fa24f115c57c9fb81ac6c0e4183
- SHA256
  
  f2bb4841e6b19d120f11b076774ad4700e7010c1f4d4bb8fb1ee8b834183c90b
- SHA512
  
  789a5760559fbc2757d8382fb31392b640673be211cee93c4bcb9a95a465b05b222f3fe14abb72947a4984193019065843825ad5a807597fc5f86281844d2acf
- SSDEEP
  
  24576:mfOyotfeirQIpaFaH1v1ydiGhuGxxjk3pppn8LbYt4/9WeQN7of0bDgq2yjUs2U2:mGnpbaFc+iGTk3pp+bF8HbUfyj
Score

7^/10

adware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2