Overview

overview

10

Static

static

7

1a8ca5309e...18.exe

windows7-x64

10

1a8ca5309e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a8ca5309e5cce7749accf0191a0bd23_JaffaCakes118

  • Size

    9.8MB

  • Sample

    240701-j2y76atgmq

  • MD5

    1a8ca5309e5cce7749accf0191a0bd23

  • SHA1

    573c7120eb4c2303afb2ff53dd5584bb6d612bf3

  • SHA256

    bb6818fa21b1fb875dda3affa2b34b682e1855251e1a2fa875af04af50d508de

  • SHA512

    3ee9f64b0d104ea47fc859929215f27ca177d648147778483ebeaba7eff3073395a7b5775868d06bcb6e68a966a39e3cc146451ba8a6c5d0be4066ad41a62da5

  • SSDEEP

    196608:i7effIPEsy58doQaTxLhQyZbIly38doQavqU/yE/QTly38doQa6wk89+hXTI5Y8p:i7effIPEsy58doQaTxLhQyZbIly38do5

Score
10/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      1a8ca5309e5cce7749accf0191a0bd23_JaffaCakes118

    • Size

      9.8MB

    • MD5

      1a8ca5309e5cce7749accf0191a0bd23

    • SHA1

      573c7120eb4c2303afb2ff53dd5584bb6d612bf3

    • SHA256

      bb6818fa21b1fb875dda3affa2b34b682e1855251e1a2fa875af04af50d508de

    • SHA512

      3ee9f64b0d104ea47fc859929215f27ca177d648147778483ebeaba7eff3073395a7b5775868d06bcb6e68a966a39e3cc146451ba8a6c5d0be4066ad41a62da5

    • SSDEEP

      196608:i7effIPEsy58doQaTxLhQyZbIly38doQavqU/yE/QTly38doQa6wk89+hXTI5Y8p:i7effIPEsy58doQaTxLhQyZbIly38do5

    Score
    10/10
    adwarepersistencestealerupx

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Browser Extensions

1
T1176

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Defense Evasion

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks