0fbd3362db586a5b206c4716aaf34efb2cab8776e3cfdd9bc1a3721c756fbf60 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e0b74946540bf2e04b9f2304d62e3e66_JaffaCakes118
Size

332KB
Sample

240914-wgw9aaxdqa
MD5

e0b74946540bf2e04b9f2304d62e3e66
SHA1

848a3997971e96eb8e907abedfeed557af6aa13b
SHA256

0fbd3362db586a5b206c4716aaf34efb2cab8776e3cfdd9bc1a3721c756fbf60
SHA512

ec9b2348d6a5c4f88a71b25e06cae2c3261a1f9acc959079a8c435917620d3029f047af508c1d68af2e6df2a7f603fb762330adda0a4e196ac9d7be5610bba4c
SSDEEP

6144:/2YsWosYgvDx0EVnA3votIvPmZwQ3HDG5rNXlJuBq/v/QZOIWLTXzT:vpYgDBVA/C4GwIHDmlJuBGQZO7Lz

Score

8^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  e0b74946540bf2e04b9f2304d62e3e66_JaffaCakes118
- Size
  
  332KB
- MD5
  
  e0b74946540bf2e04b9f2304d62e3e66
- SHA1
  
  848a3997971e96eb8e907abedfeed557af6aa13b
- SHA256
  
  0fbd3362db586a5b206c4716aaf34efb2cab8776e3cfdd9bc1a3721c756fbf60
- SHA512
  
  ec9b2348d6a5c4f88a71b25e06cae2c3261a1f9acc959079a8c435917620d3029f047af508c1d68af2e6df2a7f603fb762330adda0a4e196ac9d7be5610bba4c
- SSDEEP
  
  6144:/2YsWosYgvDx0EVnA3votIvPmZwQ3HDG5rNXlJuBq/v/QZOIWLTXzT:vpYgDBVA/C4GwIHDmlJuBGQZO7Lz
Score

8^/10

discovery evasion persistence spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealer

behavioral2