95872f6e8b9c9b2b757fc3a2c767e0ed90d37ae5ef4cede691f1d8e4a6ae8600 | Triage

Sharing

General

Target

0ab685728489a4c5ab933e198a5b752c_JaffaCakes118
Size

266KB
Sample

241002-pwpz7azgre
MD5

0ab685728489a4c5ab933e198a5b752c
SHA1

249ffe5e4327059755658455acccef901e88405f
SHA256

95872f6e8b9c9b2b757fc3a2c767e0ed90d37ae5ef4cede691f1d8e4a6ae8600
SHA512

43df03e893c145de07d9015e76227994fcfdcddc9bc79dc53b4ce9988971fe4dc1c3ad550e3b9fa4d7a02d92fd53adf49c4a1ad3a189af8dff7a5d81461ccd75
SSDEEP

6144:6Y94NuRUTV5nngfJqVlVIgn1jf8ZGUUJxDs/Vz:J9OuRUTV5nngIX1jUZAHDs/V

Score

7^/10

adware discovery persistence stealer

Malware Config

Targets

- Target
  
  0ab685728489a4c5ab933e198a5b752c_JaffaCakes118
- Size
  
  266KB
- MD5
  
  0ab685728489a4c5ab933e198a5b752c
- SHA1
  
  249ffe5e4327059755658455acccef901e88405f
- SHA256
  
  95872f6e8b9c9b2b757fc3a2c767e0ed90d37ae5ef4cede691f1d8e4a6ae8600
- SHA512
  
  43df03e893c145de07d9015e76227994fcfdcddc9bc79dc53b4ce9988971fe4dc1c3ad550e3b9fa4d7a02d92fd53adf49c4a1ad3a189af8dff7a5d81461ccd75
- SSDEEP
  
  6144:6Y94NuRUTV5nngfJqVlVIgn1jf8ZGUUJxDs/Vz:J9OuRUTV5nngIX1jUZAHDs/V
Score

7^/10

adware discovery persistence stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealer

behavioral2

adwarediscoverypersistencestealer