Overview

overview

8

Static

static

7

f0166057c4...18.exe

windows7-x64

8

f0166057c4...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f0166057c4d1af7fa52f96def73f8d94_JaffaCakes118

  • Size

    30KB

  • Sample

    240921-sty2vszajc

  • MD5

    f0166057c4d1af7fa52f96def73f8d94

  • SHA1

    ab7f174202a8a5652906bb69c0ebf9f7774dae19

  • SHA256

    20d99d051bd0679d48ae3b4f9151d3ab32ebd9bf9dc996518518b43dc7027642

  • SHA512

    562a4b4a08635b84f88b5079e06cfa074c6eff92562349304d2e7a547abb48cb63f1dd3bbf41c13735002f5cb1304e34a1658fccae261f6d75b6411f88e934ed

  • SSDEEP

    768:Ks7HqNQmTCjz73hT7Cw3oBve12wKAzdr1HK8r:KJWmTCjHhT2HExPr

Score
8/10
adwarediscoverypersistencestealerupx

Malware Config

Targets

    • Target

      f0166057c4d1af7fa52f96def73f8d94_JaffaCakes118

    • Size

      30KB

    • MD5

      f0166057c4d1af7fa52f96def73f8d94

    • SHA1

      ab7f174202a8a5652906bb69c0ebf9f7774dae19

    • SHA256

      20d99d051bd0679d48ae3b4f9151d3ab32ebd9bf9dc996518518b43dc7027642

    • SHA512

      562a4b4a08635b84f88b5079e06cfa074c6eff92562349304d2e7a547abb48cb63f1dd3bbf41c13735002f5cb1304e34a1658fccae261f6d75b6411f88e934ed

    • SSDEEP

      768:Ks7HqNQmTCjz73hT7Cw3oBve12wKAzdr1HK8r:KJWmTCjHhT2HExPr

    Score
    8/10
    adwarediscoverypersistencestealerupx

    • Adds policy Run key to start application

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks