2e02ad2032fed14c49c7c492cdebbd3815f9344846d66c59adb44b9357eddcec | Triage

Sharing

General

Target

88324cd56b00f7cd4e74151fad284f51_JaffaCakes118
Size

108KB
Sample

240811-aabhcayhpb
MD5

88324cd56b00f7cd4e74151fad284f51
SHA1

73d8358cc6cfee857f859c0de0e43273e80f5793
SHA256

2e02ad2032fed14c49c7c492cdebbd3815f9344846d66c59adb44b9357eddcec
SHA512

67983865abc39a9b3b7948d4835e8c2ab960029033c8de0243821158b6e6667d86d02d5cbbf21afa16c55c052c827ed674ff1589ad791ecf8590d3b155500726
SSDEEP

768:/0gaGEq/dXbEVO+Z/J5raoDgJCUYsN/63S8m0gaGg+EyQntBNpl2wzc5aJ:MRGPruSCU1eS8DRGxstBNpljF

Score

8^/10

adware defense_evasion discovery persistence stealer

Malware Config

Targets

- Target
  
  88324cd56b00f7cd4e74151fad284f51_JaffaCakes118
- Size
  
  108KB
- MD5
  
  88324cd56b00f7cd4e74151fad284f51
- SHA1
  
  73d8358cc6cfee857f859c0de0e43273e80f5793
- SHA256
  
  2e02ad2032fed14c49c7c492cdebbd3815f9344846d66c59adb44b9357eddcec
- SHA512
  
  67983865abc39a9b3b7948d4835e8c2ab960029033c8de0243821158b6e6667d86d02d5cbbf21afa16c55c052c827ed674ff1589ad791ecf8590d3b155500726
- SSDEEP
  
  768:/0gaGEq/dXbEVO+Z/J5raoDgJCUYsN/63S8m0gaGg+EyQntBNpl2wzc5aJ:MRGPruSCU1eS8DRGxstBNpljF
Score

8^/10

adware defense_evasion discovery persistence stealer
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwaredefense_evasiondiscoverypersistencestealer

behavioral2

adwaredefense_evasiondiscoverypersistencestealer