453da6955c691ed6adb47715e129a11f3b2f6dea826d4c815ae42fdfaa14db36 | Triage

Sharing

General

Target

25830caee95d594b6d437d8ac3b84f10_JaffaCakes118
Size

360KB
Sample

240704-lv927axcph
MD5

25830caee95d594b6d437d8ac3b84f10
SHA1

260a6dd4b44662c2da6fe5e0650a3561f6f13a04
SHA256

453da6955c691ed6adb47715e129a11f3b2f6dea826d4c815ae42fdfaa14db36
SHA512

eec5877fb6aab513bd3f001c0955bf0c68b1f34cf655cc8dc0be96e6b2bce496c126e0a3d473ae5b4a347810536a942c068c22ec0290616ca62a5b1071bb7e83
SSDEEP

6144:B8xwFE5KW6gjcdSW1vrG5qD1JTHReDMZT:BHzDdSyi5e5Rw

Score

8^/10

evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  25830caee95d594b6d437d8ac3b84f10_JaffaCakes118
- Size
  
  360KB
- MD5
  
  25830caee95d594b6d437d8ac3b84f10
- SHA1
  
  260a6dd4b44662c2da6fe5e0650a3561f6f13a04
- SHA256
  
  453da6955c691ed6adb47715e129a11f3b2f6dea826d4c815ae42fdfaa14db36
- SHA512
  
  eec5877fb6aab513bd3f001c0955bf0c68b1f34cf655cc8dc0be96e6b2bce496c126e0a3d473ae5b4a347810536a942c068c22ec0290616ca62a5b1071bb7e83
- SSDEEP
  
  6144:B8xwFE5KW6gjcdSW1vrG5qD1JTHReDMZT:BHzDdSyi5e5Rw
Score

8^/10

evasion persistence spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealer

behavioral2