Overview

overview

8

Static

static

3

889f02d585...18.exe

windows7-x64

8

889f02d585...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    889f02d585e62fa6e1a6d1cb80d952be_JaffaCakes118

  • Size

    61KB

  • Sample

    240811-cs3ewsvcpa

  • MD5

    889f02d585e62fa6e1a6d1cb80d952be

  • SHA1

    3980a32e09823cb144237e368a00b266c94d9974

  • SHA256

    45888b41214b7a9da67bb94bea38eb47cc0c73778a2e08a7ce8d835797e13aed

  • SHA512

    adfd2044fa9a47b13e9d2759e628c9ed99dc5b1b2b58de8021d3b2c3854ba1b7bc59cf1380b9e4f2f4f61971e35a960b4768ef79e61cab3c21a70a47f0aee290

  • SSDEEP

    1536:BX1hFxqX+F3isOhMqEgpjwdUFMOUgHluFRR2t/0S6:Z1hqo3HqEg6BOUU8FqH

Score
8/10
adwarediscoverypersistenceprivilege_escalationstealerupx

Malware Config

Targets

    • Target

      889f02d585e62fa6e1a6d1cb80d952be_JaffaCakes118

    • Size

      61KB

    • MD5

      889f02d585e62fa6e1a6d1cb80d952be

    • SHA1

      3980a32e09823cb144237e368a00b266c94d9974

    • SHA256

      45888b41214b7a9da67bb94bea38eb47cc0c73778a2e08a7ce8d835797e13aed

    • SHA512

      adfd2044fa9a47b13e9d2759e628c9ed99dc5b1b2b58de8021d3b2c3854ba1b7bc59cf1380b9e4f2f4f61971e35a960b4768ef79e61cab3c21a70a47f0aee290

    • SSDEEP

      1536:BX1hFxqX+F3isOhMqEgpjwdUFMOUgHluFRR2t/0S6:Z1hqo3HqEg6BOUU8FqH

    Score
    8/10
    adwarediscoverypersistenceprivilege_escalationstealerupx

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks