c047ef04e901604047ef3b8ff5a1ae3b89d8f5c9da64627de206b22bf6d6784b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

77a0cf5603ab1050c513f74b6b9c356c_JaffaCakes118
Size

138KB
Sample

240727-k7prcazcnn
MD5

77a0cf5603ab1050c513f74b6b9c356c
SHA1

61d827c5d7a5c71a890b3c52afee18977dc07b57
SHA256

c047ef04e901604047ef3b8ff5a1ae3b89d8f5c9da64627de206b22bf6d6784b
SHA512

0373e4a507ced16f9dc0129c54ab43d276be0b4029c78d9199e19e3d486a3b25020a955f6b9b0ddb61152fdf4e04eefdb26440644d3aa7f3ffaf62afcb7dc5bc
SSDEEP

3072:/caqyte6UV77snHLLxtIyaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONm6:/caBtC77snHR3Y7PNNW4IxZ7zbC0rONv

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  77a0cf5603ab1050c513f74b6b9c356c_JaffaCakes118
- Size
  
  138KB
- MD5
  
  77a0cf5603ab1050c513f74b6b9c356c
- SHA1
  
  61d827c5d7a5c71a890b3c52afee18977dc07b57
- SHA256
  
  c047ef04e901604047ef3b8ff5a1ae3b89d8f5c9da64627de206b22bf6d6784b
- SHA512
  
  0373e4a507ced16f9dc0129c54ab43d276be0b4029c78d9199e19e3d486a3b25020a955f6b9b0ddb61152fdf4e04eefdb26440644d3aa7f3ffaf62afcb7dc5bc
- SSDEEP
  
  3072:/caqyte6UV77snHLLxtIyaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONm6:/caBtC77snHR3Y7PNNW4IxZ7zbC0rONv
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2