adda323ba6c6dff2b728907819ed779c56114a07a5ed07f9ac9bc08117fe0d08 | Triage

Sharing

General

Target

c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118
Size

1.7MB
Sample

240826-gw92csyfqb
MD5

c26dde74c4e50e22121b1ec50dd30417
SHA1

c2086ad96557af08bf3d406d0b40054fd8ce5465
SHA256

adda323ba6c6dff2b728907819ed779c56114a07a5ed07f9ac9bc08117fe0d08
SHA512

968563b793f2f01f0def5312fd79f0b5600a0034a2f2a771c39cf20f2ee37602aefe67a878f0fe8fdeff2ce5bb8df2916f6b15b1688be0fc01f7eab5160d6839
SSDEEP

3072:A4tngvlGPo7OmH2MGn8hEXRjCC1K0mKGVpeH:3ytGPyOetGnNXRj+Re

Score

8^/10

adware collection discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118
- Size
  
  1.7MB
- MD5
  
  c26dde74c4e50e22121b1ec50dd30417
- SHA1
  
  c2086ad96557af08bf3d406d0b40054fd8ce5465
- SHA256
  
  adda323ba6c6dff2b728907819ed779c56114a07a5ed07f9ac9bc08117fe0d08
- SHA512
  
  968563b793f2f01f0def5312fd79f0b5600a0034a2f2a771c39cf20f2ee37602aefe67a878f0fe8fdeff2ce5bb8df2916f6b15b1688be0fc01f7eab5160d6839
- SSDEEP
  
  3072:A4tngvlGPo7OmH2MGn8hEXRjCC1K0mKGVpeH:3ytGPyOetGnNXRj+Re
Score

8^/10

adware collection discovery persistence spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarecollectiondiscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer