78e8153fb5c219333faef9c402602ca367e0e99b9ab67186b889445190c1d775 | Triage

Sharing

General

Target

859ad0af1ab161183eaa046cd9ce3caf_JaffaCakes118
Size

3.6MB
Sample

240810-lljtmsycmb
MD5

859ad0af1ab161183eaa046cd9ce3caf
SHA1

4c25c86444cd0ebc1f1cc4d0e2f9fafd4cfc4728
SHA256

78e8153fb5c219333faef9c402602ca367e0e99b9ab67186b889445190c1d775
SHA512

6c4ec928da4b73e884c936a109965ad0236ef34a96973bfac822063ee1a40b6bf1e50b5c03bfb5ed4cd38e51c2789a5c00f147e544e4fc6269c99a0df2cc8a1b
SSDEEP

49152:gi19lGb2ZVGwrmAuZPMZVUsPbS6OeaBYMGEb2MX2PZXZDKENd5FRrEabwH/e:RA2ZgAumZV/bVTMGEbR2P5ZvB4G

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  859ad0af1ab161183eaa046cd9ce3caf_JaffaCakes118
- Size
  
  3.6MB
- MD5
  
  859ad0af1ab161183eaa046cd9ce3caf
- SHA1
  
  4c25c86444cd0ebc1f1cc4d0e2f9fafd4cfc4728
- SHA256
  
  78e8153fb5c219333faef9c402602ca367e0e99b9ab67186b889445190c1d775
- SHA512
  
  6c4ec928da4b73e884c936a109965ad0236ef34a96973bfac822063ee1a40b6bf1e50b5c03bfb5ed4cd38e51c2789a5c00f147e544e4fc6269c99a0df2cc8a1b
- SSDEEP
  
  49152:gi19lGb2ZVGwrmAuZPMZVUsPbS6OeaBYMGEb2MX2PZXZDKENd5FRrEabwH/e:RA2ZgAumZV/bVTMGEbR2P5ZvB4G
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2