Overview

overview

8

Static

static

3

1a309596c9...18.dll

windows7-x64

8

1a309596c9...18.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a309596c9bb24df4a97b6a2fb3967bf_JaffaCakes118

  • Size

    472KB

  • Sample

    240628-p4ejestbnn

  • MD5

    1a309596c9bb24df4a97b6a2fb3967bf

  • SHA1

    75677094b4b78bbe0e07b5c35f1a371d14cd1d57

  • SHA256

    c75ce9d9dc660ddc87b315dd90ee11f70a88ac78cfd82008958f102e9a8c9bc5

  • SHA512

    6040a5314ee5db4737f07c5ad90edd8d5713a481a5718067d4695b46b1871cddd2735f3059a567cb57de733884d10eff4872f91a6d16cabaf91f1f1be4feaf1b

  • SSDEEP

    12288:gIx3n4BiTNvjrwy15K1Q4e0TsSk7h77wNpTYLb8:gIx3JNLrr5KbQ/7h7S4

Score
8/10
adwarebootkitpersistencestealer

Malware Config

Targets

    • Target

      1a309596c9bb24df4a97b6a2fb3967bf_JaffaCakes118

    • Size

      472KB

    • MD5

      1a309596c9bb24df4a97b6a2fb3967bf

    • SHA1

      75677094b4b78bbe0e07b5c35f1a371d14cd1d57

    • SHA256

      c75ce9d9dc660ddc87b315dd90ee11f70a88ac78cfd82008958f102e9a8c9bc5

    • SHA512

      6040a5314ee5db4737f07c5ad90edd8d5713a481a5718067d4695b46b1871cddd2735f3059a567cb57de733884d10eff4872f91a6d16cabaf91f1f1be4feaf1b

    • SSDEEP

      12288:gIx3n4BiTNvjrwy15K1Q4e0TsSk7h77wNpTYLb8:gIx3JNLrr5KbQ/7h7S4

    Score
    8/10
    adwarebootkitpersistencestealer

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Browser Extensions

1
T1176

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks