Overview

overview

7

Static

static

3

04fe616619...18.exe

windows7-x64

7

04fe616619...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04fe616619eb2b1a612fd1dd130f89bd_JaffaCakes118

  • Size

    20.4MB

  • Sample

    240428-mlx7psdg47

  • MD5

    04fe616619eb2b1a612fd1dd130f89bd

  • SHA1

    99938d2adfcea7ce4a5d52061409a2462cebe835

  • SHA256

    1a7f568d562c3f85c4f79b34a41eef8c4aab28c9d7677ef7b6ead11328f2b58a

  • SHA512

    b39aec9d50fe175e43f1d9562c2fdfea734be0f921b4b5f29a2502a937142ea1c04fb89a3fc145f937e20a81cd16aaede6774259c1938defaa52869d9ff748d0

  • SSDEEP

    49152:XYgph7GBfWgBYcMbHP/4MnYYJ2ZhqSGLHkJEMwDkYOMwwnMb4PmyVOz/4MnYYJ2G:XX77GBfWgB5rIDQdYOXwnS4rVOsIDQ2

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      04fe616619eb2b1a612fd1dd130f89bd_JaffaCakes118

    • Size

      20.4MB

    • MD5

      04fe616619eb2b1a612fd1dd130f89bd

    • SHA1

      99938d2adfcea7ce4a5d52061409a2462cebe835

    • SHA256

      1a7f568d562c3f85c4f79b34a41eef8c4aab28c9d7677ef7b6ead11328f2b58a

    • SHA512

      b39aec9d50fe175e43f1d9562c2fdfea734be0f921b4b5f29a2502a937142ea1c04fb89a3fc145f937e20a81cd16aaede6774259c1938defaa52869d9ff748d0

    • SSDEEP

      49152:XYgph7GBfWgBYcMbHP/4MnYYJ2ZhqSGLHkJEMwDkYOMwwnMb4PmyVOz/4MnYYJ2G:XX77GBfWgB5rIDQdYOXwnS4rVOsIDQ2

    Score
    7/10
    spywarestealerpersistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks