8def5f026c4302d74c401a91e8fc4d0b97df29b4a86891653437551a2f36ca43 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddb5ed2d2352e6ccc160ab8f6b8e23a8_JaffaCakes118
Size

4.5MB
Sample

240913-fhcm9swang
MD5

ddb5ed2d2352e6ccc160ab8f6b8e23a8
SHA1

77ba57bb69ed82bb2f867401214e5f8c61f7e6b7
SHA256

8def5f026c4302d74c401a91e8fc4d0b97df29b4a86891653437551a2f36ca43
SHA512

25512fd92581b6a0276d105d8e3ef96fd22b6ad5d3746c0aec5cb18ba28567897b5947f7708aa7d748cf154d17c2f514c2a4675f5df182f432fc1d6ccf39e5c0
SSDEEP

98304:NJQdgbEFuY4KRTClJiGWfUezRyd0wbuKgamrFM:6e1JKJCjiXzRyG4jb

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  ddb5ed2d2352e6ccc160ab8f6b8e23a8_JaffaCakes118
- Size
  
  4.5MB
- MD5
  
  ddb5ed2d2352e6ccc160ab8f6b8e23a8
- SHA1
  
  77ba57bb69ed82bb2f867401214e5f8c61f7e6b7
- SHA256
  
  8def5f026c4302d74c401a91e8fc4d0b97df29b4a86891653437551a2f36ca43
- SHA512
  
  25512fd92581b6a0276d105d8e3ef96fd22b6ad5d3746c0aec5cb18ba28567897b5947f7708aa7d748cf154d17c2f514c2a4675f5df182f432fc1d6ccf39e5c0
- SSDEEP
  
  98304:NJQdgbEFuY4KRTClJiGWfUezRyd0wbuKgamrFM:6e1JKJCjiXzRyG4jb
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistence