804b034fd0846d3037f452808d0f8a6322d4da81f42dc686bc2ddafe7a8f5fd1 | Triage

Sharing

General

Target

6f495ca4f37f6c77e110e2ae804c9c08_JaffaCakes118
Size

99KB
Sample

240725-m21mrsvcqk
MD5

6f495ca4f37f6c77e110e2ae804c9c08
SHA1

3da30d63003b11372b70c0bc4adc267d47c63659
SHA256

804b034fd0846d3037f452808d0f8a6322d4da81f42dc686bc2ddafe7a8f5fd1
SHA512

9a5daf360f779e86d727f095980d498bdf2129c59c53f12fa39e810be0946a3f99a70412f300b5d792a8314090a6c8e04b1469f5c0d45a72683370c338b3ec05
SSDEEP

3072:oxzukNo3QbZhED4CA8sy/zsVNH+iu0zW0:okSogbZt8dsfV

Score

10^/10

adware discovery evasion stealer

Malware Config

Targets

- Target
  
  6f495ca4f37f6c77e110e2ae804c9c08_JaffaCakes118
- Size
  
  99KB
- MD5
  
  6f495ca4f37f6c77e110e2ae804c9c08
- SHA1
  
  3da30d63003b11372b70c0bc4adc267d47c63659
- SHA256
  
  804b034fd0846d3037f452808d0f8a6322d4da81f42dc686bc2ddafe7a8f5fd1
- SHA512
  
  9a5daf360f779e86d727f095980d498bdf2129c59c53f12fa39e810be0946a3f99a70412f300b5d792a8314090a6c8e04b1469f5c0d45a72683370c338b3ec05
- SSDEEP
  
  3072:oxzukNo3QbZhED4CA8sy/zsVNH+iu0zW0:okSogbZt8dsfV
Score

10^/10

adware discovery evasion stealer
- Modifies firewall policy service
  evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryevasionstealer

behavioral2

adwarediscoveryevasionstealer