General

  • Target

    2ffb2dc1947e351eebcafb5388b1b78d_JaffaCakes118

  • Size

    130KB

  • Sample

    241010-p74ygssbjm

  • MD5

    2ffb2dc1947e351eebcafb5388b1b78d

  • SHA1

    0694563b61bfa96f7b51e78ae62ee8fe4d3b7b1e

  • SHA256

    46264d841dc40c44d71e1973216c431c9786396aa9f368318c74a4b518cd14e0

  • SHA512

    78139cd9536ce9a0eb0718962aa0b03fe1624629f5ee841d2e4b7cc5eeecc21bca09df9083fbf09b1b3a30da41c6d980963b8567064fd7a99fe05f7be1e08e0e

  • SSDEEP

    1536:DmsuQJc7vZ1bZIgf8pC++5B3ZOk4EEJtlY463Q8asf74pIpJJR7EJTZ:DmQc7fbZh0pb+5L/3EJtlYdA8aS74goZ

Malware Config

Targets

    • Target

      2ffb2dc1947e351eebcafb5388b1b78d_JaffaCakes118

    • Size

      130KB

    • MD5

      2ffb2dc1947e351eebcafb5388b1b78d

    • SHA1

      0694563b61bfa96f7b51e78ae62ee8fe4d3b7b1e

    • SHA256

      46264d841dc40c44d71e1973216c431c9786396aa9f368318c74a4b518cd14e0

    • SHA512

      78139cd9536ce9a0eb0718962aa0b03fe1624629f5ee841d2e4b7cc5eeecc21bca09df9083fbf09b1b3a30da41c6d980963b8567064fd7a99fe05f7be1e08e0e

    • SSDEEP

      1536:DmsuQJc7vZ1bZIgf8pC++5B3ZOk4EEJtlY463Q8asf74pIpJJR7EJTZ:DmQc7fbZh0pb+5L/3EJtlYdA8aS74goZ

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Blocklisted process makes network request

    • Server Software Component: Terminal Services DLL

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Drops file in System32 directory

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks