badbc96d2550b110179ebc4800c3cdf6c7cc2507c29bcc5d659ecba21307888e | Triage

Sharing

General

Target

a00fe918ff084c9fc79df34f5b608324_JaffaCakes118
Size

138KB
Sample

240816-1nhrpaserp
MD5

a00fe918ff084c9fc79df34f5b608324
SHA1

15b341c9ba3b60bd89cb9d0429e50cbe95e9c509
SHA256

badbc96d2550b110179ebc4800c3cdf6c7cc2507c29bcc5d659ecba21307888e
SHA512

f681cfa838b99272b1d47879f39fe1b7654f50a4c048e5dc2b5b734320ad2679f4077f9531351176ca4898b416fce5bbbb99beeedaa0f5e4b6d016159de1ef75
SSDEEP

3072:/caqyte6YV77snHLLxtAyaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONmw:/caBtW77snHRTY7PNNW4IxZ7zbC0rONh

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  a00fe918ff084c9fc79df34f5b608324_JaffaCakes118
- Size
  
  138KB
- MD5
  
  a00fe918ff084c9fc79df34f5b608324
- SHA1
  
  15b341c9ba3b60bd89cb9d0429e50cbe95e9c509
- SHA256
  
  badbc96d2550b110179ebc4800c3cdf6c7cc2507c29bcc5d659ecba21307888e
- SHA512
  
  f681cfa838b99272b1d47879f39fe1b7654f50a4c048e5dc2b5b734320ad2679f4077f9531351176ca4898b416fce5bbbb99beeedaa0f5e4b6d016159de1ef75
- SSDEEP
  
  3072:/caqyte6YV77snHLLxtAyaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONmw:/caBtW77snHRTY7PNNW4IxZ7zbC0rONh
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2