0a11af9877335d87013cd8ce275ae47437bd07b7809e826dd7fcf4d234f2e185 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf53d25c1a91d99726df717d57f24750_JaffaCakes118
Size

90KB
Sample

240906-mey6es1brk
MD5

cf53d25c1a91d99726df717d57f24750
SHA1

0f4d4b5e7e63887b3bd31408ded17463e5432bde
SHA256

0a11af9877335d87013cd8ce275ae47437bd07b7809e826dd7fcf4d234f2e185
SHA512

da224163612aca3d8adec6ad7f2f82261692be9015bc178c3d4888176d3eae9f3a3850d28c0917314093c67e5045142d8872501bca548a01ae957956651ec59b
SSDEEP

1536:93pcLd0gpByLfa2W13Xpx9wRhE1q9JrvXnXVztWQFp0DLP8vQiMQZw8p:fWufRm3XpsRG1MJTXVzDr8LP8YFQZw

Score

10^/10

adware discovery evasion stealer

Malware Config

Targets

- Target
  
  cf53d25c1a91d99726df717d57f24750_JaffaCakes118
- Size
  
  90KB
- MD5
  
  cf53d25c1a91d99726df717d57f24750
- SHA1
  
  0f4d4b5e7e63887b3bd31408ded17463e5432bde
- SHA256
  
  0a11af9877335d87013cd8ce275ae47437bd07b7809e826dd7fcf4d234f2e185
- SHA512
  
  da224163612aca3d8adec6ad7f2f82261692be9015bc178c3d4888176d3eae9f3a3850d28c0917314093c67e5045142d8872501bca548a01ae957956651ec59b
- SSDEEP
  
  1536:93pcLd0gpByLfa2W13Xpx9wRhE1q9JrvXnXVztWQFp0DLP8vQiMQZw8p:fWufRm3XpsRG1MJTXVzDr8LP8YFQZw
Score

10^/10

adware discovery evasion stealer
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryevasionstealer

behavioral2

adwarediscoveryevasionstealer