Overview

overview

10

Static

static

8

JaffaCakes...db.xls

windows7-x64

10

JaffaCakes...db.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_34c1b41e19977bea70e481344bb22997847eea00e35c04f36ed4a81f8556a8db

  • Size

    2.7MB

  • Sample

    241221-xghxbswncv

  • MD5

    5a0d2e3b52fe4cf7d627c098d86f1557

  • SHA1

    011aade7c013edc076e0b8c75d07c6362b797a43

  • SHA256

    34c1b41e19977bea70e481344bb22997847eea00e35c04f36ed4a81f8556a8db

  • SHA512

    8f689adbc41821071eba45009d6ffdb7853bd8b55ce41a3716fc020ba95a75173b7bb88399cc894751108e180ae9eccf70c5a9e5c0eab85923192a871f6f7489

  • SSDEEP

    24576:PufOgVAsEaXNN693SGipBEYg5t4ATR9giW5YEk4tpJwBBmvRROTU8fvSTXZv:sb

Score
10/10
mimikatzbootkitdiscoverymacromacro_on_actionpersistencespywarestealer

Malware Config

Targets

    • Target

      JaffaCakes118_34c1b41e19977bea70e481344bb22997847eea00e35c04f36ed4a81f8556a8db

    • Size

      2.7MB

    • MD5

      5a0d2e3b52fe4cf7d627c098d86f1557

    • SHA1

      011aade7c013edc076e0b8c75d07c6362b797a43

    • SHA256

      34c1b41e19977bea70e481344bb22997847eea00e35c04f36ed4a81f8556a8db

    • SHA512

      8f689adbc41821071eba45009d6ffdb7853bd8b55ce41a3716fc020ba95a75173b7bb88399cc894751108e180ae9eccf70c5a9e5c0eab85923192a871f6f7489

    • SSDEEP

      24576:PufOgVAsEaXNN693SGipBEYg5t4ATR9giW5YEk4tpJwBBmvRROTU8fvSTXZv:sb

    Score
    10/10
    mimikatzbootkitdiscoverypersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks