2f697ab30f5f7bc7d75c620efe28faaf9abc0990892e315700db021d5a693ace | Triage

Sharing

General

Target

6ab40a9e5be0ac9b74cc2c845884d61d_JaffaCakes118
Size

132KB
Sample

240724-h22slsxbrd
MD5

6ab40a9e5be0ac9b74cc2c845884d61d
SHA1

9992edc7c84670bf1e8bb9e8f0ff92ec98cc9591
SHA256

2f697ab30f5f7bc7d75c620efe28faaf9abc0990892e315700db021d5a693ace
SHA512

38586df734acfe3ef16db9e57a46a59ac3f766e394584b3e69dfbb89f024c81c367960ab237f2827106a90c5335370d389d60105c9f6967c7578a3c9750b7b4a
SSDEEP

1536:tczGXpWH8HywBS2b4WjX2K89sn30aDWughYf6rO7tu1Ky+ppXP5CkCajVYi:ttXj7bRG85IrU5yW1P5rn

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  6ab40a9e5be0ac9b74cc2c845884d61d_JaffaCakes118
- Size
  
  132KB
- MD5
  
  6ab40a9e5be0ac9b74cc2c845884d61d
- SHA1
  
  9992edc7c84670bf1e8bb9e8f0ff92ec98cc9591
- SHA256
  
  2f697ab30f5f7bc7d75c620efe28faaf9abc0990892e315700db021d5a693ace
- SHA512
  
  38586df734acfe3ef16db9e57a46a59ac3f766e394584b3e69dfbb89f024c81c367960ab237f2827106a90c5335370d389d60105c9f6967c7578a3c9750b7b4a
- SSDEEP
  
  1536:tczGXpWH8HywBS2b4WjX2K89sn30aDWughYf6rO7tu1Ky+ppXP5CkCajVYi:ttXj7bRG85IrU5yW1P5rn
Score

7^/10

persistence spyware stealer discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

discoverypersistencespywarestealer