General

  • Target

    73efec1ae006782b4dbfd7b2598ace36_JaffaCakes118

  • Size

    58KB

  • Sample

    240726-n1xp6awbpq

  • MD5

    73efec1ae006782b4dbfd7b2598ace36

  • SHA1

    0801da32812b04787758ef758356665202cdbaac

  • SHA256

    fef6005a18ce3e686d6e25aec9174497580a19f50c17533fa498c4c2ecc2ff41

  • SHA512

    10719d7dc4cf7c63c46db088a81d00224bcdf3336a8336259f46787dbfd6621e43492be7c0245e9c93e7833e9ffd5b3e1293c1c86baf5a035e5b44b04c4cd546

  • SSDEEP

    1536:Aq+x9fvssmLaMeyiJmvURXkCgeSLckO8zCBk+ha6:Aqwvs7LcccRXkCgeL8zSpa

Malware Config

Targets

    • Target

      73efec1ae006782b4dbfd7b2598ace36_JaffaCakes118

    • Size

      58KB

    • MD5

      73efec1ae006782b4dbfd7b2598ace36

    • SHA1

      0801da32812b04787758ef758356665202cdbaac

    • SHA256

      fef6005a18ce3e686d6e25aec9174497580a19f50c17533fa498c4c2ecc2ff41

    • SHA512

      10719d7dc4cf7c63c46db088a81d00224bcdf3336a8336259f46787dbfd6621e43492be7c0245e9c93e7833e9ffd5b3e1293c1c86baf5a035e5b44b04c4cd546

    • SSDEEP

      1536:Aq+x9fvssmLaMeyiJmvURXkCgeSLckO8zCBk+ha6:Aqwvs7LcccRXkCgeL8zSpa

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks