eb8822c96b2e8865e1172e05c1e1c4dea99f99c958fc5ef9c3da6d7dcfa9e8fb | Triage

Sharing

General

Target

83630afad023e2772082cba2d37d14e3_JaffaCakes118
Size

344KB
Sample

240802-hdnaba1dqk
MD5

83630afad023e2772082cba2d37d14e3
SHA1

74b8ae4cd153c640c7d226306e1d4766fca0584d
SHA256

eb8822c96b2e8865e1172e05c1e1c4dea99f99c958fc5ef9c3da6d7dcfa9e8fb
SHA512

77f3403b13217460f38c9ace86f2e06282eb84d6fdc3d5abba05a6262d4f5a1ed247115bac68ef680eb5b062afd423a4214e48ebd300215a15ff2c172e922ede
SSDEEP

6144:XRuvorkeA3NiqkGZWcwbyotVIVCHCD67BQweziY1JNOkpU:hxAQeZKzIUHG6dQnzi87PpU

Score

8^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  83630afad023e2772082cba2d37d14e3_JaffaCakes118
- Size
  
  344KB
- MD5
  
  83630afad023e2772082cba2d37d14e3
- SHA1
  
  74b8ae4cd153c640c7d226306e1d4766fca0584d
- SHA256
  
  eb8822c96b2e8865e1172e05c1e1c4dea99f99c958fc5ef9c3da6d7dcfa9e8fb
- SHA512
  
  77f3403b13217460f38c9ace86f2e06282eb84d6fdc3d5abba05a6262d4f5a1ed247115bac68ef680eb5b062afd423a4214e48ebd300215a15ff2c172e922ede
- SSDEEP
  
  6144:XRuvorkeA3NiqkGZWcwbyotVIVCHCD67BQweziY1JNOkpU:hxAQeZKzIUHG6dQnzi87PpU
Score

8^/10

discovery evasion persistence spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealer

behavioral2