e0687e1034ca5ca8fdaab6d47488314573c6577956bc4043f3ccf0967e75ede7 | Triage

Sharing

General

Target

442e813dc63197f4cc5c71b2968c45d1_JaffaCakes118
Size

74KB
Sample

240714-edvgvavhmm
MD5

442e813dc63197f4cc5c71b2968c45d1
SHA1

db8b1f548d10ebadc926ae1fdf417773594ecbe4
SHA256

e0687e1034ca5ca8fdaab6d47488314573c6577956bc4043f3ccf0967e75ede7
SHA512

2b1559f55876f333a29d064f870822617af391e8d36cfff0054bb41e47883a42c69694ced821a2a6f4f163706f19a94e349dff40818ce281f9406321a87f473f
SSDEEP

1536:JX5EHuzMEtVOXzZaY0ZIgJMtuBhU8nERkFWBqrT7QF96LSGxxrb:Jo8YJGOuNEWFsQU/Uzzb

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  442e813dc63197f4cc5c71b2968c45d1_JaffaCakes118
- Size
  
  74KB
- MD5
  
  442e813dc63197f4cc5c71b2968c45d1
- SHA1
  
  db8b1f548d10ebadc926ae1fdf417773594ecbe4
- SHA256
  
  e0687e1034ca5ca8fdaab6d47488314573c6577956bc4043f3ccf0967e75ede7
- SHA512
  
  2b1559f55876f333a29d064f870822617af391e8d36cfff0054bb41e47883a42c69694ced821a2a6f4f163706f19a94e349dff40818ce281f9406321a87f473f
- SSDEEP
  
  1536:JX5EHuzMEtVOXzZaY0ZIgJMtuBhU8nERkFWBqrT7QF96LSGxxrb:Jo8YJGOuNEWFsQU/Uzzb
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer