6f91eca36aa14b86826e4b008fe53e80ffdc0c9c670302db948522be67a77c3e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d15591a270f8a9e482a4492b315f2464_JaffaCakes118
Size

12KB
Sample

240907-hqajzs1cke
MD5

d15591a270f8a9e482a4492b315f2464
SHA1

4ee973ea71b577a451d08e355cce455658f10160
SHA256

6f91eca36aa14b86826e4b008fe53e80ffdc0c9c670302db948522be67a77c3e
SHA512

9632a2018cab93095d8ae7bf3197ce386652c1bd6ab66a7a1372964412fcb2888358003ced3419c5f5d65b1f6087258618629eb19be986087d9b84f971e712ba
SSDEEP

192:gC8kCK41WmVCIetpjO222KzJMBeZONAFvMG0zMtgPRYZoTozqFxU7HQbKpap:R1C1BstopaeFhYlRQzuQHMeY

Score

8^/10

adware defense_evasion discovery persistence stealer

Malware Config

Targets

- Target
  
  d15591a270f8a9e482a4492b315f2464_JaffaCakes118
- Size
  
  12KB
- MD5
  
  d15591a270f8a9e482a4492b315f2464
- SHA1
  
  4ee973ea71b577a451d08e355cce455658f10160
- SHA256
  
  6f91eca36aa14b86826e4b008fe53e80ffdc0c9c670302db948522be67a77c3e
- SHA512
  
  9632a2018cab93095d8ae7bf3197ce386652c1bd6ab66a7a1372964412fcb2888358003ced3419c5f5d65b1f6087258618629eb19be986087d9b84f971e712ba
- SSDEEP
  
  192:gC8kCK41WmVCIetpjO222KzJMBeZONAFvMG0zMtgPRYZoTozqFxU7HQbKpap:R1C1BstopaeFhYlRQzuQHMeY
Score

8^/10

adware defense_evasion discovery persistence stealer
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwaredefense_evasiondiscoverypersistencestealer

behavioral2

adwaredefense_evasiondiscoverypersistencestealer