01df08aaf6177ee7e2a4c9389c10be0ebc5f8675e80e000f4dc4edb34334bf44 | Triage

Sharing

General

Target

5a62ed380b979507e849a190c2146894_JaffaCakes118
Size

328KB
Sample

240719-eljqbavere
MD5

5a62ed380b979507e849a190c2146894
SHA1

79d08c54eaab3e6cea054a7365d23075d0acc580
SHA256

01df08aaf6177ee7e2a4c9389c10be0ebc5f8675e80e000f4dc4edb34334bf44
SHA512

d610ad7370bbbe70ff35418e5d72676a5198c355af7af6db80d0dc1136efe9f85925f370cecc933b920c4a6f2f1738870059718bb9c4e2209a2a19aa8520023f
SSDEEP

6144:wqJbiJMuADeTxa1Fy9zaCjWcqVGAcdsBzj9AOHf6kogFD:wqpjuA6Tw2jeokDfVoAD

Score

8^/10

evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  5a62ed380b979507e849a190c2146894_JaffaCakes118
- Size
  
  328KB
- MD5
  
  5a62ed380b979507e849a190c2146894
- SHA1
  
  79d08c54eaab3e6cea054a7365d23075d0acc580
- SHA256
  
  01df08aaf6177ee7e2a4c9389c10be0ebc5f8675e80e000f4dc4edb34334bf44
- SHA512
  
  d610ad7370bbbe70ff35418e5d72676a5198c355af7af6db80d0dc1136efe9f85925f370cecc933b920c4a6f2f1738870059718bb9c4e2209a2a19aa8520023f
- SSDEEP
  
  6144:wqJbiJMuADeTxa1Fy9zaCjWcqVGAcdsBzj9AOHf6kogFD:wqpjuA6Tw2jeokDfVoAD
Score

8^/10

evasion persistence spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealer

behavioral2