5d32576eb5828b909231b3a7c7abd5afd68a908fd0ddecb6384d418f49b29fc2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03ff6db996c087cfa342d64abbc2ddce_JaffaCakes118
Size

138KB
Sample

240428-a1m9tscb52
MD5

03ff6db996c087cfa342d64abbc2ddce
SHA1

d631e6945f3406cb1f7c405744d66074a82baae1
SHA256

5d32576eb5828b909231b3a7c7abd5afd68a908fd0ddecb6384d418f49b29fc2
SHA512

2982ab0253b71c78e1996d6abfa9ffaa6c944bc6eafb1c754158f0dfff155addfa1c644b011a58095e6f3cea079fc85cf0999cdad3e23ae1a9c83be64f1253de
SSDEEP

3072:teqAVWZkushrKFg7BuqCGFMSlPHUj5IcfFxoRUNZTxs83VrpP:tJASDYl1up8HUj5IcQUfxLrl

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  03ff6db996c087cfa342d64abbc2ddce_JaffaCakes118
- Size
  
  138KB
- MD5
  
  03ff6db996c087cfa342d64abbc2ddce
- SHA1
  
  d631e6945f3406cb1f7c405744d66074a82baae1
- SHA256
  
  5d32576eb5828b909231b3a7c7abd5afd68a908fd0ddecb6384d418f49b29fc2
- SHA512
  
  2982ab0253b71c78e1996d6abfa9ffaa6c944bc6eafb1c754158f0dfff155addfa1c644b011a58095e6f3cea079fc85cf0999cdad3e23ae1a9c83be64f1253de
- SSDEEP
  
  3072:teqAVWZkushrKFg7BuqCGFMSlPHUj5IcfFxoRUNZTxs83VrpP:tJASDYl1up8HUj5IcQUfxLrl
Score

7^/10

persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2