711996a64e0aa2a4382e73046e3da05ee69a07111fa6fa7c075da4a56949dd59 | Triage

Sharing

General

Target

0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118
Size

551KB
Sample

241002-yfptxstbmp
MD5

0c36eb21adcae8b6f737b4fd29a5ed5a
SHA1

0ec6bc81e5a4fe9b9e2208128b577530aad2237d
SHA256

711996a64e0aa2a4382e73046e3da05ee69a07111fa6fa7c075da4a56949dd59
SHA512

a5820eed1e1e204ea8c557adf52dfc741f94dc88a4a5cbc4c9574962b20ecb7185b1b685d2d3fbf0afe4b046c246245171007b599656b9b83bddb68d2f7189ae
SSDEEP

12288:h1OgLdaOv1Wctn+MEfOUgbJuMmFcouJqkP:h1OYdaOdtMOUgJHJJqkP

Score

7^/10

adware discovery stealer

Malware Config

Targets

- Target
  
  0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118
- Size
  
  551KB
- MD5
  
  0c36eb21adcae8b6f737b4fd29a5ed5a
- SHA1
  
  0ec6bc81e5a4fe9b9e2208128b577530aad2237d
- SHA256
  
  711996a64e0aa2a4382e73046e3da05ee69a07111fa6fa7c075da4a56949dd59
- SHA512
  
  a5820eed1e1e204ea8c557adf52dfc741f94dc88a4a5cbc4c9574962b20ecb7185b1b685d2d3fbf0afe4b046c246245171007b599656b9b83bddb68d2f7189ae
- SSDEEP
  
  12288:h1OgLdaOv1Wctn+MEfOUgbJuMmFcouJqkP:h1OYdaOdtMOUgJHJJqkP
Score

7^/10

adware discovery stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverystealer

behavioral2

adwarediscoverystealer