4fc371d56223ad9a441fd056abf5d879846b040183dd49ad465c6d9111728fda | Triage

Sharing

General

Target

b5fdc9452d7cd3ccda9973d010f23f12_JaffaCakes118
Size

138KB
Sample

240822-cvpa2stfkc
MD5

b5fdc9452d7cd3ccda9973d010f23f12
SHA1

d82fabdfd5c5d5bcfd713ea5a55b4a8e8105a123
SHA256

4fc371d56223ad9a441fd056abf5d879846b040183dd49ad465c6d9111728fda
SHA512

d7ee45e7cf1b8635f552de6d8e9832c292db68dc42617f75afc0e093dc41543c86e8f66b1a3c352a8ae5b70e7d17681a2ba1aae28caf5d662d629b1d39b7fce5
SSDEEP

3072:7tsaTXp2uHKN/BDzh/5jrCIHer7Zmv3HSruNyLamWjMAKdWrc:7Garp2uHKNfYJmaiNyVWPdrc

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  b5fdc9452d7cd3ccda9973d010f23f12_JaffaCakes118
- Size
  
  138KB
- MD5
  
  b5fdc9452d7cd3ccda9973d010f23f12
- SHA1
  
  d82fabdfd5c5d5bcfd713ea5a55b4a8e8105a123
- SHA256
  
  4fc371d56223ad9a441fd056abf5d879846b040183dd49ad465c6d9111728fda
- SHA512
  
  d7ee45e7cf1b8635f552de6d8e9832c292db68dc42617f75afc0e093dc41543c86e8f66b1a3c352a8ae5b70e7d17681a2ba1aae28caf5d662d629b1d39b7fce5
- SSDEEP
  
  3072:7tsaTXp2uHKN/BDzh/5jrCIHer7Zmv3HSruNyLamWjMAKdWrc:7Garp2uHKNfYJmaiNyVWPdrc
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2