Overview

overview

10

Static

static

3

2e5c2446f8...18.exe

windows7-x64

10

2e5c2446f8...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2e5c2446f85164d845d585645922cc62_JaffaCakes118

  • Size

    274KB

  • Sample

    241009-kzcrtasapj

  • MD5

    2e5c2446f85164d845d585645922cc62

  • SHA1

    e5d8e44a5eaf3b5ee80c12ffb0c226afc75700ae

  • SHA256

    dd59264648ac20500bf61a73f8612039d3a1f7c9d4001bdb0e0410152fa44b5b

  • SHA512

    133716bc55cffb583b0f390f94cc59a04530c1d5fe6efa80702c4e1b7c28998a5b2dbf92fd396a0b32e5f9c4f61212609c5964f4c639f893b9d39719205d35d2

  • SSDEEP

    6144:CpJdxPzEBBUbDvb5KvfIm0y+FQ3qffFZ32HU3eo6wNp0hvfnhN:MzEnU9iwmfeQ3qf9E0uKNpyT

Score
10/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      2e5c2446f85164d845d585645922cc62_JaffaCakes118

    • Size

      274KB

    • MD5

      2e5c2446f85164d845d585645922cc62

    • SHA1

      e5d8e44a5eaf3b5ee80c12ffb0c226afc75700ae

    • SHA256

      dd59264648ac20500bf61a73f8612039d3a1f7c9d4001bdb0e0410152fa44b5b

    • SHA512

      133716bc55cffb583b0f390f94cc59a04530c1d5fe6efa80702c4e1b7c28998a5b2dbf92fd396a0b32e5f9c4f61212609c5964f4c639f893b9d39719205d35d2

    • SSDEEP

      6144:CpJdxPzEBBUbDvb5KvfIm0y+FQ3qffFZ32HU3eo6wNp0hvfnhN:MzEnU9iwmfeQ3qf9E0uKNpyT

    Score
    10/10
    adwarediscoverypersistencestealer

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks