Overview

overview

10

Static

static

7

a432426414...18.exe

windows7-x64

10

a432426414...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a432426414d6e64ee78325f92c60c299_JaffaCakes118

  • Size

    6.3MB

  • Sample

    240817-1amtgszhqj

  • MD5

    a432426414d6e64ee78325f92c60c299

  • SHA1

    ef95d85d3e88065a1f4035735124eb70d52c63eb

  • SHA256

    8cc30cc7d4ec7c2af5ee79855fbc039a8cd5bc14c0990c992a6311d523d0ec7f

  • SHA512

    11a65b2b49bfa40ad0871c14d6e1602fe1d1cda02eb169ad39f44b8a8d64e4d7474ed87ba78bb09a9ca9fade9064d7ebf0f133e4533da3ee8b3fb4bbbf39a831

  • SSDEEP

    196608:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu6cnqVtxQni4f8sJE23Gd/sX:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxq

Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Targets

    • Target

      a432426414d6e64ee78325f92c60c299_JaffaCakes118

    • Size

      6.3MB

    • MD5

      a432426414d6e64ee78325f92c60c299

    • SHA1

      ef95d85d3e88065a1f4035735124eb70d52c63eb

    • SHA256

      8cc30cc7d4ec7c2af5ee79855fbc039a8cd5bc14c0990c992a6311d523d0ec7f

    • SHA512

      11a65b2b49bfa40ad0871c14d6e1602fe1d1cda02eb169ad39f44b8a8d64e4d7474ed87ba78bb09a9ca9fade9064d7ebf0f133e4533da3ee8b3fb4bbbf39a831

    • SSDEEP

      196608:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu6cnqVtxQni4f8sJE23Gd/sX:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxq

    Score
    10/10
    adwarediscoverypersistencestealerupx

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks