Overview

overview

8

Static

static

3

d3139de09b...18.exe

windows7-x64

7

d3139de09b...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    d3139de09bb0b25ee603a731766ae949_JaffaCakes118

  • Size

    862KB

  • Sample

    240907-3r7w4avara

  • MD5

    d3139de09bb0b25ee603a731766ae949

  • SHA1

    737750ff45bb592b4142c4a8104758d0012c02c4

  • SHA256

    4a6537c05e6bffb13918c98a2a3c154ca9e123954a56646990be3373ed91f862

  • SHA512

    20251d45363d4ab12b183f53181f0f69c8cc193f1c3cd55e98314fb4c6c0207a16b225fea576274fd03ea7912d00c21a589dc9b50476b1df59f486757365944f

  • SSDEEP

    24576:JNlPU8JXlkY0qf4g7NWljJ1Vq7O0+58GBtXM6:J/PUulkDVg7NWJlMPRGX

Score
8/10
bootkitdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      d3139de09bb0b25ee603a731766ae949_JaffaCakes118

    • Size

      862KB

    • MD5

      d3139de09bb0b25ee603a731766ae949

    • SHA1

      737750ff45bb592b4142c4a8104758d0012c02c4

    • SHA256

      4a6537c05e6bffb13918c98a2a3c154ca9e123954a56646990be3373ed91f862

    • SHA512

      20251d45363d4ab12b183f53181f0f69c8cc193f1c3cd55e98314fb4c6c0207a16b225fea576274fd03ea7912d00c21a589dc9b50476b1df59f486757365944f

    • SSDEEP

      24576:JNlPU8JXlkY0qf4g7NWljJ1Vq7O0+58GBtXM6:J/PUulkDVg7NWJlMPRGX

    Score
    8/10
    bootkitdiscoverypersistencespywarestealer

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks