General

  • Target

    73ec1ada8eb42c52a30d067fe8fcd6af_JaffaCakes118

  • Size

    73KB

  • Sample

    240726-nx3r1awamn

  • MD5

    73ec1ada8eb42c52a30d067fe8fcd6af

  • SHA1

    2a3e954329b0beb21b33c3351667664005f5f645

  • SHA256

    2ad39dcc3dc493afbd3e7e21c5cd2874a3f79ae61336c601b97df9cb074fa699

  • SHA512

    c20c68d9b69a9e881255bd6b96dea9cf7fb427a05dab985f3c85d88ec16ba90ab7956142da0fb995ad4e33499d06b5c5d882fb078c3387706c1647aee8d52e87

  • SSDEEP

    1536:XpDxG4VwE3k3iVDg2eMt/lZWEir2NL0+s+HK:9xJwEUSVDnByEik0qq

Malware Config

Targets

    • Target

      73ec1ada8eb42c52a30d067fe8fcd6af_JaffaCakes118

    • Size

      73KB

    • MD5

      73ec1ada8eb42c52a30d067fe8fcd6af

    • SHA1

      2a3e954329b0beb21b33c3351667664005f5f645

    • SHA256

      2ad39dcc3dc493afbd3e7e21c5cd2874a3f79ae61336c601b97df9cb074fa699

    • SHA512

      c20c68d9b69a9e881255bd6b96dea9cf7fb427a05dab985f3c85d88ec16ba90ab7956142da0fb995ad4e33499d06b5c5d882fb078c3387706c1647aee8d52e87

    • SSDEEP

      1536:XpDxG4VwE3k3iVDg2eMt/lZWEir2NL0+s+HK:9xJwEUSVDnByEik0qq

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

1
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks