Overview

overview

10

Static

static

3

d1ea79ea14...18.exe

windows7-x64

10

d1ea79ea14...18.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    d1ea79ea1463576436a7e68f37a2901d_JaffaCakes118

  • Size

    13KB

  • Sample

    240907-pfqlsaterr

  • MD5

    d1ea79ea1463576436a7e68f37a2901d

  • SHA1

    c969c95c7a457d6ea5ec3de4f72a07c4f3e056a4

  • SHA256

    fecd4ce82f2210ed55571058b64d6a156876a0e9176d998b37575cf1b3cecf1c

  • SHA512

    51c789732b1c80ff671d8e41f0db89481f8f72542500f2b3d254d16954078a80e80cd175d694a0f5eebaa6cfce085411daa0f6c5d4b40b534ce47ac0195a6aa7

  • SSDEEP

    192:xqdsICa/p0PtSFqMa7p/Ok5fvIYXQLFXh6hY1CYT2X8M3cpksHrNINEd7nLVdpGV:x2gtNO4IYXQ5X4oCYqX8MscunJ/GVMa

Score
10/10
defense_evasiondiscoveryevasionpersistencespywarestealer

Malware Config

Targets

    • Target

      d1ea79ea1463576436a7e68f37a2901d_JaffaCakes118

    • Size

      13KB

    • MD5

      d1ea79ea1463576436a7e68f37a2901d

    • SHA1

      c969c95c7a457d6ea5ec3de4f72a07c4f3e056a4

    • SHA256

      fecd4ce82f2210ed55571058b64d6a156876a0e9176d998b37575cf1b3cecf1c

    • SHA512

      51c789732b1c80ff671d8e41f0db89481f8f72542500f2b3d254d16954078a80e80cd175d694a0f5eebaa6cfce085411daa0f6c5d4b40b534ce47ac0195a6aa7

    • SSDEEP

      192:xqdsICa/p0PtSFqMa7p/Ok5fvIYXQLFXh6hY1CYT2X8M3cpksHrNINEd7nLVdpGV:x2gtNO4IYXQ5X4oCYqX8MscunJ/GVMa

    Score
    10/10
    defense_evasiondiscoveryevasionpersistencespywarestealer

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion

    • Modifies WinLogon

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Registry

4
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks