851e320cc7dfe74a1fdaa6c209b2711630e19722bb9c557931e05ac706345b99 | Triage

Sharing

General

Target

0341ba72b65f1f6113c07d2df284b3f2_JaffaCakes118
Size

173KB
Sample

240620-f9d1ea1grf
MD5

0341ba72b65f1f6113c07d2df284b3f2
SHA1

4e193c06700fc0d15c3cc0d96ad8890922069242
SHA256

851e320cc7dfe74a1fdaa6c209b2711630e19722bb9c557931e05ac706345b99
SHA512

98bdd105e5fcc10a97c0daee24f0793ebc3037f24fc7721da2693fcc47e4543ae07cae868645837a1b6f0cefecea19e224fcf8fa0f2f650059caedc9dafc44c7
SSDEEP

3072:bPzcHip1DsnFcEAggAJ4bBxyQvaMGysCO00HAfLmPFPvoW6V3ofbeK+SIzFOvJq:ncHw1Ya3ggjbyYaJysCYHemNoW69oxIO

Score

7^/10

persistence spyware stealer upx

Malware Config

Targets

- Target
  
  0341ba72b65f1f6113c07d2df284b3f2_JaffaCakes118
- Size
  
  173KB
- MD5
  
  0341ba72b65f1f6113c07d2df284b3f2
- SHA1
  
  4e193c06700fc0d15c3cc0d96ad8890922069242
- SHA256
  
  851e320cc7dfe74a1fdaa6c209b2711630e19722bb9c557931e05ac706345b99
- SHA512
  
  98bdd105e5fcc10a97c0daee24f0793ebc3037f24fc7721da2693fcc47e4543ae07cae868645837a1b6f0cefecea19e224fcf8fa0f2f650059caedc9dafc44c7
- SSDEEP
  
  3072:bPzcHip1DsnFcEAggAJ4bBxyQvaMGysCO00HAfLmPFPvoW6V3ofbeK+SIzFOvJq:ncHw1Ya3ggjbyYaJysCYHemNoW69oxIO
Score

7^/10

persistence spyware stealer upx
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealerupx

behavioral2