General

  • Target

    4b01f89bf6611601c2c1ac004606aecf_JaffaCakes118

  • Size

    893KB

  • Sample

    241016-ctm2lasbnk

  • MD5

    4b01f89bf6611601c2c1ac004606aecf

  • SHA1

    c2431eba48d2e632fd44ff1b3f0405cbb3d21e4c

  • SHA256

    7eb6db1de8876af1bb1aad2f1f49876d5e4d6770b09e4cf1a0eeabccf7c5ec84

  • SHA512

    fba8f85ca4e292c66ad94224264c173b099c800aa0a0320db2fed73ec7270ff212d2b7d4028503f676d589aa3724de29e04f7f5308358b05b877821f1331e5f6

  • SSDEEP

    24576:JlheKZxVn8dE59Y3/adJjAJW5mEMyv09:J7JZx1Oapte

Malware Config

Targets

    • Target

      4b01f89bf6611601c2c1ac004606aecf_JaffaCakes118

    • Size

      893KB

    • MD5

      4b01f89bf6611601c2c1ac004606aecf

    • SHA1

      c2431eba48d2e632fd44ff1b3f0405cbb3d21e4c

    • SHA256

      7eb6db1de8876af1bb1aad2f1f49876d5e4d6770b09e4cf1a0eeabccf7c5ec84

    • SHA512

      fba8f85ca4e292c66ad94224264c173b099c800aa0a0320db2fed73ec7270ff212d2b7d4028503f676d589aa3724de29e04f7f5308358b05b877821f1331e5f6

    • SSDEEP

      24576:JlheKZxVn8dE59Y3/adJjAJW5mEMyv09:J7JZx1Oapte

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks