General
- Target jaffacakes118_Worm.Win32.AutoRun.edrh.d23b534cf2c6065bf5bd8f878d9b528a
- Size 230KB
- Sample261014-p91c3sgc65
- SHA256 b1bc1550aba87dbd056448a5f62f1a22c0a8fb7a4d2b42549b7acbe157027275
Malware Config
Targets
-
- Target jaffacakes118_Worm.Win32.AutoRun.edrh.d23b534cf2c6065bf5bd8f878d9b528a
- Size 230KB
- SHA256 b1bc1550aba87dbd056448a5f62f1a22c0a8fb7a4d2b42549b7acbe157027275
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Network Share Discovery
Attempt to gather information on host network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Active Setup
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Active Setup
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1