b4ed4637cccd997870068114c3c7d1d1cd49625620e9880a8161555b00ba2e2a | Triage

Sharing

General

Target

ad4748d01ef07b43d3f2cb3add9da911_JaffaCakes118
Size

144KB
Sample

240820-a9na7ayhmp
MD5

ad4748d01ef07b43d3f2cb3add9da911
SHA1

e1ae4f4512d6b98c81d18d7cdf9a24dbc6d0ef0d
SHA256

b4ed4637cccd997870068114c3c7d1d1cd49625620e9880a8161555b00ba2e2a
SHA512

e3c10bbd7a0adcc5f58d5c286de2f49713792bae1b2269c8ac308795d5c78c54de912a3f3cd0f8965dd41f311ac8c04d3e8442e0554cc8bfbcf5450b8d0d433f
SSDEEP

3072:MrMUqcZLEHGtzbPTHfEfXRp79MPcSI9SFcZtAbmy+nIdIe/:Mr1HEHwPPEhMPcSI9SFfll

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  ad4748d01ef07b43d3f2cb3add9da911_JaffaCakes118
- Size
  
  144KB
- MD5
  
  ad4748d01ef07b43d3f2cb3add9da911
- SHA1
  
  e1ae4f4512d6b98c81d18d7cdf9a24dbc6d0ef0d
- SHA256
  
  b4ed4637cccd997870068114c3c7d1d1cd49625620e9880a8161555b00ba2e2a
- SHA512
  
  e3c10bbd7a0adcc5f58d5c286de2f49713792bae1b2269c8ac308795d5c78c54de912a3f3cd0f8965dd41f311ac8c04d3e8442e0554cc8bfbcf5450b8d0d433f
- SSDEEP
  
  3072:MrMUqcZLEHGtzbPTHfEfXRp79MPcSI9SFcZtAbmy+nIdIe/:Mr1HEHwPPEhMPcSI9SFfll
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Network Share Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2