Overview

overview

9

Static

static

3

dc6b98b970...18.exe

windows7-x64

9

dc6b98b970...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc6b98b9707c0922ab6a53b3efdd5dac_JaffaCakes118

  • Size

    199KB

  • Sample

    240912-rtb2nayfkl

  • MD5

    dc6b98b9707c0922ab6a53b3efdd5dac

  • SHA1

    a72e76fbd5dfa53b3d27ed9d9e6d194a085d7d0e

  • SHA256

    f55d6bd5f13356eda64fae070a5eee1a080f06a0aa69bdd7e137496d88346be3

  • SHA512

    04b730c73876fc89eb465ebc069ad1e1bdbfbf5d1654a4bb49457d87ec290dd1832a571dea47adabea0d3f3c0461f8ce70d10fe2e4a82cbb698fed254c5d269b

  • SSDEEP

    3072:hegn0/CPJCVJx55PUw9B/kRdOm+OiSTW+EJ2Fm5KEUxR4:heT6PJKJTkrOm+jl+E/Q8

Score
9/10
defense_evasiondiscoverylateral_movementpersistencespywarestealer

Malware Config

Targets

    • Target

      dc6b98b9707c0922ab6a53b3efdd5dac_JaffaCakes118

    • Size

      199KB

    • MD5

      dc6b98b9707c0922ab6a53b3efdd5dac

    • SHA1

      a72e76fbd5dfa53b3d27ed9d9e6d194a085d7d0e

    • SHA256

      f55d6bd5f13356eda64fae070a5eee1a080f06a0aa69bdd7e137496d88346be3

    • SHA512

      04b730c73876fc89eb465ebc069ad1e1bdbfbf5d1654a4bb49457d87ec290dd1832a571dea47adabea0d3f3c0461f8ce70d10fe2e4a82cbb698fed254c5d269b

    • SSDEEP

      3072:hegn0/CPJCVJx55PUw9B/kRdOm+OiSTW+EJ2Fm5KEUxR4:heT6PJKJTkrOm+jl+E/Q8

    Score
    9/10
    defense_evasiondiscoverylateral_movementpersistencespywarestealer

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Remote Service Session Hijacking: RDP Hijacking

      Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

      lateral_movement

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Password Policy Discovery

      Attempt to access detailed information about the password policy used within an enterprise network.

      discovery

    • Hide Artifacts: Hidden Users

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Hide Artifacts

1
T1564

Hidden Users

1
T1564.002

Credential Access

Unsecured Credentials

1
T1552

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Password Policy Discovery

1
T1201

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Remote System Discovery

1
T1018

Lateral Movement

Remote Service Session Hijacking

1
T1563

RDP Hijacking

1
T1563.002

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks