General

  • Target

    bc6fb32faf6601757fe2871625b09e1b_JaffaCakes118

  • Size

    220KB

  • Sample

    240618-rv2cya1hrj

  • MD5

    bc6fb32faf6601757fe2871625b09e1b

  • SHA1

    38ee28b763e92d7febacb8d83ad55b22c441d8d5

  • SHA256

    ed607e330620bc325855c510f4d719a005220e6c74bff8ea7ede25eb5ff1168a

  • SHA512

    8acdf813ca0311bf239eff7d3e625d64b632263460c8997a461cb4f9a5b3b832e0b77f8846923a9d87e5f4a92903fb39fa39e6c156023d23a5ebfb9a9972dbe7

  • SSDEEP

    3072:GzOTph2zI9ue29x+3j3ZPgBhh+cXd9sEbAqb3FSwMbdkUHwNkjyT8ZznlWz4F:XT2zI9uvx8ziBhhhnTbVqbdkUHwSdQz

Malware Config

Targets

    • Target

      bc6fb32faf6601757fe2871625b09e1b_JaffaCakes118

    • Size

      220KB

    • MD5

      bc6fb32faf6601757fe2871625b09e1b

    • SHA1

      38ee28b763e92d7febacb8d83ad55b22c441d8d5

    • SHA256

      ed607e330620bc325855c510f4d719a005220e6c74bff8ea7ede25eb5ff1168a

    • SHA512

      8acdf813ca0311bf239eff7d3e625d64b632263460c8997a461cb4f9a5b3b832e0b77f8846923a9d87e5f4a92903fb39fa39e6c156023d23a5ebfb9a9972dbe7

    • SSDEEP

      3072:GzOTph2zI9ue29x+3j3ZPgBhh+cXd9sEbAqb3FSwMbdkUHwNkjyT8ZznlWz4F:XT2zI9uvx8ziBhhhnTbVqbdkUHwSdQz

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks