0d59cf1f40f79516e27384c8a5fd6acd9c74b4da1bc971634c703951e68e89bc | Triage

Sharing

General

Target

2e1506b946b1fdf1f0c3c2e67e048f7b_JaffaCakes118
Size

1.5MB
Sample

240708-2lxy9svfke
MD5

2e1506b946b1fdf1f0c3c2e67e048f7b
SHA1

538b228270eb4de2419887d9f64cc610b9727de3
SHA256

0d59cf1f40f79516e27384c8a5fd6acd9c74b4da1bc971634c703951e68e89bc
SHA512

3e6b8d0734d9450c6fc00519d3678d5c123565c3c9831c531578cb6ee58966aecba715428f97e011985683ad9114cac2c7bc59a7d5152b77bcef886b878e28ea
SSDEEP

24576:430Nh0hW/AhqPksuz6Y6HAlzlbFvMSBflkek4CKzzhOcbiTW:43MPtuz6Y6H8fvMkl6QEcbiTW

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Targets

- Target
  
  2e1506b946b1fdf1f0c3c2e67e048f7b_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  2e1506b946b1fdf1f0c3c2e67e048f7b
- SHA1
  
  538b228270eb4de2419887d9f64cc610b9727de3
- SHA256
  
  0d59cf1f40f79516e27384c8a5fd6acd9c74b4da1bc971634c703951e68e89bc
- SHA512
  
  3e6b8d0734d9450c6fc00519d3678d5c123565c3c9831c531578cb6ee58966aecba715428f97e011985683ad9114cac2c7bc59a7d5152b77bcef886b878e28ea
- SSDEEP
  
  24576:430Nh0hW/AhqPksuz6Y6HAlzlbFvMSBflkek4CKzzhOcbiTW:43MPtuz6Y6H8fvMkl6QEcbiTW
Score

7^/10

discovery persistence privilege_escalation spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalationspywarestealer

behavioral2

discoverypersistenceprivilege_escalationspywarestealer