1a3ccf19e06e06339183e6864b2636632d9f1a1beddda77ea0dbaf2d5e64cfcf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bb51bffe068e22d1d91dae5613db359b_JaffaCakes118
Size

368KB
Sample

240823-macrma1aql
MD5

bb51bffe068e22d1d91dae5613db359b
SHA1

f41840d091741420f4fb4e6b1c772696e036d8c8
SHA256

1a3ccf19e06e06339183e6864b2636632d9f1a1beddda77ea0dbaf2d5e64cfcf
SHA512

c485cd10f78a6586a3916d56581af8b19ba9f25b88b18d457d7ec9bde4a4b3c745bbb15ac71aa46e614de7c2b5fc8cfa8936ed7a9fe5618c290937b5ef88eab6
SSDEEP

3072:b0TBCO2pBz+ew5AjdS180ATni6W3JWKapQ2JRn7q00nnQEa7r0Z6VfK9Jr:bTO2j+ew5AjdS180IK92v78za7r0j

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  bb51bffe068e22d1d91dae5613db359b_JaffaCakes118
- Size
  
  368KB
- MD5
  
  bb51bffe068e22d1d91dae5613db359b
- SHA1
  
  f41840d091741420f4fb4e6b1c772696e036d8c8
- SHA256
  
  1a3ccf19e06e06339183e6864b2636632d9f1a1beddda77ea0dbaf2d5e64cfcf
- SHA512
  
  c485cd10f78a6586a3916d56581af8b19ba9f25b88b18d457d7ec9bde4a4b3c745bbb15ac71aa46e614de7c2b5fc8cfa8936ed7a9fe5618c290937b5ef88eab6
- SSDEEP
  
  3072:b0TBCO2pBz+ew5AjdS180ATni6W3JWKapQ2JRn7q00nnQEa7r0Z6VfK9Jr:bTO2j+ew5AjdS180IK92v78za7r0j
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer