Overview

overview

10

Static

static

3

ee8dea938e...18.exe

windows7-x64

10

ee8dea938e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee8dea938e65344fb2f8f2d3e1ab9335_JaffaCakes118

  • Size

    7.6MB

  • Sample

    240920-2gebcsscjn

  • MD5

    ee8dea938e65344fb2f8f2d3e1ab9335

  • SHA1

    9f54311afd3e6a2f5875ea9af75b68571313a617

  • SHA256

    d9c162f7a5d46fc96e2404fa73584b4e2dee6dbf9fb5aee3e1d706e97237fc9e

  • SHA512

    0f357cc8d6896ba256190929a0aa8f0a158e8fb449949f7f9ac538513dd3312c128630b4315397d55c37765955947d2ec8511ab8a1426a8e58e3a2a8d5cbee2b

  • SSDEEP

    196608:N7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXI1G8do8hFqyfX:N7effIPEsy58doQaTxLhQyZbIly38doY

Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Targets

    • Target

      ee8dea938e65344fb2f8f2d3e1ab9335_JaffaCakes118

    • Size

      7.6MB

    • MD5

      ee8dea938e65344fb2f8f2d3e1ab9335

    • SHA1

      9f54311afd3e6a2f5875ea9af75b68571313a617

    • SHA256

      d9c162f7a5d46fc96e2404fa73584b4e2dee6dbf9fb5aee3e1d706e97237fc9e

    • SHA512

      0f357cc8d6896ba256190929a0aa8f0a158e8fb449949f7f9ac538513dd3312c128630b4315397d55c37765955947d2ec8511ab8a1426a8e58e3a2a8d5cbee2b

    • SSDEEP

      196608:N7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXI1G8do8hFqyfX:N7effIPEsy58doQaTxLhQyZbIly38doY

    Score
    10/10
    adwarediscoverypersistencestealerupx

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks