Overview

overview

10

Static

static

3

edbe0b538e...18.exe

windows7-x64

edbe0b538e...18.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edbe0b538e2c8428fd5bfecb066f9921_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240920-rawlyszgqk

  • MD5

    edbe0b538e2c8428fd5bfecb066f9921

  • SHA1

    706d1dd3a31e11c578a38db05dd50a2c49ffc4cd

  • SHA256

    3bb489de34df3c2bbe7684a562f3eae17e5c66b1b82c13011bf250768eb79603

  • SHA512

    b3e98dc74119bf7e34dc6049a6e00ed44d83700822749396a1eff5e3f0c032cdc85f9eb5092bca163758d95e907b737aad42256e12a069e3a29a98ded179e18b

  • SSDEEP

    3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score
10/10
defense_evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      edbe0b538e2c8428fd5bfecb066f9921_JaffaCakes118

    • Size

      1.1MB

    • MD5

      edbe0b538e2c8428fd5bfecb066f9921

    • SHA1

      706d1dd3a31e11c578a38db05dd50a2c49ffc4cd

    • SHA256

      3bb489de34df3c2bbe7684a562f3eae17e5c66b1b82c13011bf250768eb79603

    • SHA512

      b3e98dc74119bf7e34dc6049a6e00ed44d83700822749396a1eff5e3f0c032cdc85f9eb5092bca163758d95e907b737aad42256e12a069e3a29a98ded179e18b

    • SSDEEP

      3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

    Score
    10/10
    persistencespywarestealerdefense_evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds policy Run key to start application

      persistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks