d4821b868eca163f5d645847bbf224003ea3479a4e3f6f3f408d9ac7f5420a69 | Triage

Sharing

General

Target

e25dbd139b267dc08eb10c6e5a9e03ae_JaffaCakes118
Size

142KB
Sample

240915-ng3gas1dpe
MD5

e25dbd139b267dc08eb10c6e5a9e03ae
SHA1

daa0dbed95076fd223f02239ef71c4c679d1b923
SHA256

d4821b868eca163f5d645847bbf224003ea3479a4e3f6f3f408d9ac7f5420a69
SHA512

97a636cbd5f0628cd3723afb25feec0c6d09a07577a9126d1b49c63cc63e11e97fd542763512f3c6a8bc041bed648d81c8d5d64294879712bcc6bfafe69e2c77
SSDEEP

3072:3bnfJk5eMXmCQgxHgiTDXbpxWLTVqT6/X2YyQhIP0+pt3ImKSsTjnB:3bRkYCrHg6TfWfVYkmYV8t3cSsf

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  e25dbd139b267dc08eb10c6e5a9e03ae_JaffaCakes118
- Size
  
  142KB
- MD5
  
  e25dbd139b267dc08eb10c6e5a9e03ae
- SHA1
  
  daa0dbed95076fd223f02239ef71c4c679d1b923
- SHA256
  
  d4821b868eca163f5d645847bbf224003ea3479a4e3f6f3f408d9ac7f5420a69
- SHA512
  
  97a636cbd5f0628cd3723afb25feec0c6d09a07577a9126d1b49c63cc63e11e97fd542763512f3c6a8bc041bed648d81c8d5d64294879712bcc6bfafe69e2c77
- SSDEEP
  
  3072:3bnfJk5eMXmCQgxHgiTDXbpxWLTVqT6/X2YyQhIP0+pt3ImKSsTjnB:3bRkYCrHg6TfWfVYkmYV8t3cSsf
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2