469f105893f8858812e23b50bb258df9acad9061262898565e92b06a22f80dc9 | Triage

Sharing

General

Target

a0e217358ffce9488657d17fa8976aef_JaffaCakes118
Size

154KB
Sample

240817-c1ad3swanl
MD5

a0e217358ffce9488657d17fa8976aef
SHA1

c6eb314907cc5a7af519c5d9bf5b74687ec07aac
SHA256

469f105893f8858812e23b50bb258df9acad9061262898565e92b06a22f80dc9
SHA512

d8d690bad4c1e9169a14b515ac412d9ec67dffe6d2b2a0a4e94db0d219538d05691b1e5dbd884cb81a088495edbb42ee3748cba6183e77d5eeeab966a0a25eba
SSDEEP

3072:CbLKx/xfRZawAJ/tLpTDVP5PQ7NL5ZuHqIdEpXJTTyrXS:gKbRZ0/TptWt5ZmqIdyFTyj

Score

10^/10

adware discovery evasion persistence stealer trojan upx

Malware Config

Targets

- Target
  
  a0e217358ffce9488657d17fa8976aef_JaffaCakes118
- Size
  
  154KB
- MD5
  
  a0e217358ffce9488657d17fa8976aef
- SHA1
  
  c6eb314907cc5a7af519c5d9bf5b74687ec07aac
- SHA256
  
  469f105893f8858812e23b50bb258df9acad9061262898565e92b06a22f80dc9
- SHA512
  
  d8d690bad4c1e9169a14b515ac412d9ec67dffe6d2b2a0a4e94db0d219538d05691b1e5dbd884cb81a088495edbb42ee3748cba6183e77d5eeeab966a0a25eba
- SSDEEP
  
  3072:CbLKx/xfRZawAJ/tLpTDVP5PQ7NL5ZuHqIdEpXJTTyrXS:gKbRZ0/TptWt5ZmqIdyFTyj
Score

10^/10

adware discovery evasion persistence stealer trojan upx
- UAC bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryevasionpersistencestealertrojanupx

behavioral2

adwarediscoveryevasionpersistencestealertrojanupx