644c62687a429c1df4c841b7b89df3490293cb2f42269446ff0b547076a99953 | Triage

Sharing

General

Target

c940bb519c163c605a42ebc1c3aee1d5_JaffaCakes118
Size

2.0MB
Sample

240829-vphkesscja
MD5

c940bb519c163c605a42ebc1c3aee1d5
SHA1

de4d6ba4c9a9b498c497116dfa40199bfef9a938
SHA256

644c62687a429c1df4c841b7b89df3490293cb2f42269446ff0b547076a99953
SHA512

3b283006159f31fc730967640ca944a92561db8e648df5da7a45cc10b6b126fb8c855deb4da2d4b492569d9495a1739162da5cda0b71c0a88ab9eb75e527012b
SSDEEP

49152:rupmpkkZnlTEnjWaRkOTlVRF9Uc8lHUY21gue5:Qynnl4jWaD/RFi7l0be

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c940bb519c163c605a42ebc1c3aee1d5_JaffaCakes118
- Size
  
  2.0MB
- MD5
  
  c940bb519c163c605a42ebc1c3aee1d5
- SHA1
  
  de4d6ba4c9a9b498c497116dfa40199bfef9a938
- SHA256
  
  644c62687a429c1df4c841b7b89df3490293cb2f42269446ff0b547076a99953
- SHA512
  
  3b283006159f31fc730967640ca944a92561db8e648df5da7a45cc10b6b126fb8c855deb4da2d4b492569d9495a1739162da5cda0b71c0a88ab9eb75e527012b
- SSDEEP
  
  49152:rupmpkkZnlTEnjWaRkOTlVRF9Uc8lHUY21gue5:Qynnl4jWaD/RFi7l0be
Score

7^/10

discovery spyware stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer