Overview

overview

8

Static

static

3

002b9b4892...18.exe

windows7-x64

8

002b9b4892...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    002b9b4892871dfbbfe9711a7c30035a_JaffaCakes118

  • Size

    268KB

  • Sample

    240930-jby5gasgjn

  • MD5

    002b9b4892871dfbbfe9711a7c30035a

  • SHA1

    b4885d96538f47da5ad12e15dcada9f2321e3295

  • SHA256

    b82e10e3af9c88e86e5127d76f1b36132c24b7366b28777bd66b72d974c7ad1f

  • SHA512

    fdaa4f69dd8758649758290493877f475c580b0ab91caca866648beaddd70e3871e6ebda2a0f9c3fd93eed00ea496681e8a8b7e5c4e8831bb2a148be64c59fb2

  • SSDEEP

    6144:Uu3dwQ0I2dERJ9G3KKcOYDooecMEnSFtpzKTcI1W:ZNQERJYaK4DI/1zKo6W

Score
8/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      002b9b4892871dfbbfe9711a7c30035a_JaffaCakes118

    • Size

      268KB

    • MD5

      002b9b4892871dfbbfe9711a7c30035a

    • SHA1

      b4885d96538f47da5ad12e15dcada9f2321e3295

    • SHA256

      b82e10e3af9c88e86e5127d76f1b36132c24b7366b28777bd66b72d974c7ad1f

    • SHA512

      fdaa4f69dd8758649758290493877f475c580b0ab91caca866648beaddd70e3871e6ebda2a0f9c3fd93eed00ea496681e8a8b7e5c4e8831bb2a148be64c59fb2

    • SSDEEP

      6144:Uu3dwQ0I2dERJ9G3KKcOYDooecMEnSFtpzKTcI1W:ZNQERJYaK4DI/1zKo6W

    Score
    8/10
    adwarediscoverypersistencestealer

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks