d675f81960e27a32b69e02cae2dd6c58327c5378bce4a9e6142630d7fffdb051 | Triage

Sharing

General

Target

36b3356906581a9501b10b8f2cb1414e_JaffaCakes118
Size

647KB
Sample

241011-zfm6rssfmh
MD5

36b3356906581a9501b10b8f2cb1414e
SHA1

f0dea476f2fa001a364590635de5cf6691489f5e
SHA256

d675f81960e27a32b69e02cae2dd6c58327c5378bce4a9e6142630d7fffdb051
SHA512

4a4f3c511aaed6b65bd4edefda540ef791ce11fe8a7acd8dc6eee18c6cb16de9fadc5c0417434da29ceb9fb328075b3b6167cf6336c96cbfcfb97686a6d2f61d
SSDEEP

12288:twZ+r2ML1m+WEB3b6zZwlAAG72vDj6knSFcYTnKuVPYlFdRAT:tg+rdL2EB3uz6A172v6kndeKOPYluT

Score

7^/10

adware discovery persistence stealer

Malware Config

Targets

- Target
  
  36b3356906581a9501b10b8f2cb1414e_JaffaCakes118
- Size
  
  647KB
- MD5
  
  36b3356906581a9501b10b8f2cb1414e
- SHA1
  
  f0dea476f2fa001a364590635de5cf6691489f5e
- SHA256
  
  d675f81960e27a32b69e02cae2dd6c58327c5378bce4a9e6142630d7fffdb051
- SHA512
  
  4a4f3c511aaed6b65bd4edefda540ef791ce11fe8a7acd8dc6eee18c6cb16de9fadc5c0417434da29ceb9fb328075b3b6167cf6336c96cbfcfb97686a6d2f61d
- SSDEEP
  
  12288:twZ+r2ML1m+WEB3b6zZwlAAG72vDj6knSFcYTnKuVPYlFdRAT:tg+rdL2EB3uz6A172v6kndeKOPYluT
Score

7^/10

adware discovery persistence stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealer

behavioral2

adwarediscoverypersistencestealer