General

  • Target

    JaffaCakes118_e8338610a7c11e612b6c87a6f6f6e7e3

  • Size

    648KB

  • Sample

    250211-tymeassqet

  • MD5

    e8338610a7c11e612b6c87a6f6f6e7e3

  • SHA1

    438a475c2b8d1a809abc6d712bd97e0b5dd3535f

  • SHA256

    3f7987960e18db7d87c0f4b6fdbb2a097de3d27db72dfa9413a312d13b74b44e

  • SHA512

    6a1529f519019b2f54f6a83a01acec401271468e5094adf0c23d76308ec84665692cab5a4e7a65258dd6f59a5e61a32406d57da4710b0ca7ff3db36b28bcf934

  • SSDEEP

    12288:vt8wMMFPcbH3tUepvt4c70Y70mS92B2JL2L3VFfl6ij/JsB34QTET2KGh23Nc:18IqHxpvbgY7G2B2JiZ9l6GQX02Pv

Malware Config

Targets

    • Target

      JaffaCakes118_e8338610a7c11e612b6c87a6f6f6e7e3

    • Size

      648KB

    • MD5

      e8338610a7c11e612b6c87a6f6f6e7e3

    • SHA1

      438a475c2b8d1a809abc6d712bd97e0b5dd3535f

    • SHA256

      3f7987960e18db7d87c0f4b6fdbb2a097de3d27db72dfa9413a312d13b74b44e

    • SHA512

      6a1529f519019b2f54f6a83a01acec401271468e5094adf0c23d76308ec84665692cab5a4e7a65258dd6f59a5e61a32406d57da4710b0ca7ff3db36b28bcf934

    • SSDEEP

      12288:vt8wMMFPcbH3tUepvt4c70Y70mS92B2JL2L3VFfl6ij/JsB34QTET2KGh23Nc:18IqHxpvbgY7G2B2JiZ9l6GQX02Pv

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks