General

  • Target

    704c2f936848dfa5411fee364349e038_JaffaCakes118

  • Size

    438KB

  • Sample

    240725-tk9bxasgrf

  • MD5

    704c2f936848dfa5411fee364349e038

  • SHA1

    a02e2b12d40a821bff2c67b78b3d076ad6056f80

  • SHA256

    8272d8c81f46a4b8768e0da6934dae145182858e49b9cc888f617a0cd8495f8a

  • SHA512

    5e76df5f4344e0984dd85e2ecb4d215741aa9104e4c8961a898b2f037daa39e01947d52d64f74f355325325a036551b13ecbf83294f8f72673840dc8f96c9c85

  • SSDEEP

    6144:9BBuotOq868pddVoi7CPMU1Und6JqJCAL4WsXz11PDhTAXBg:96k87lsMU249z6Bg

Malware Config

Targets

    • Target

      704c2f936848dfa5411fee364349e038_JaffaCakes118

    • Size

      438KB

    • MD5

      704c2f936848dfa5411fee364349e038

    • SHA1

      a02e2b12d40a821bff2c67b78b3d076ad6056f80

    • SHA256

      8272d8c81f46a4b8768e0da6934dae145182858e49b9cc888f617a0cd8495f8a

    • SHA512

      5e76df5f4344e0984dd85e2ecb4d215741aa9104e4c8961a898b2f037daa39e01947d52d64f74f355325325a036551b13ecbf83294f8f72673840dc8f96c9c85

    • SSDEEP

      6144:9BBuotOq868pddVoi7CPMU1Und6JqJCAL4WsXz11PDhTAXBg:96k87lsMU249z6Bg

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks