005d806db1872ff20a13f7a200c994eeee426a63c8512eeaffab202a1e5ea037 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6e099e46b35fb312caa30529d068940_JaffaCakes118
Size

119KB
Sample

240925-z546ks1fkf
MD5

f6e099e46b35fb312caa30529d068940
SHA1

53d65e84bf71ff5dc9833fe7bd7ca1161d4244c3
SHA256

005d806db1872ff20a13f7a200c994eeee426a63c8512eeaffab202a1e5ea037
SHA512

17fddf5546f5a463b1db23d66924592fd76339dd2808504e828b7ccf6c599738b47a24b9ed3a0675b4c01021d05a7f92cc0421370c67e47fbf073f5665463e55
SSDEEP

768:gyhT6fJ3RzXcQ95LRMua722c3NBqE4E9nIWmwTnaCbPmyxLfXIj9:gyhu7zbJsILqdKndmwTaeHBg

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  f6e099e46b35fb312caa30529d068940_JaffaCakes118
- Size
  
  119KB
- MD5
  
  f6e099e46b35fb312caa30529d068940
- SHA1
  
  53d65e84bf71ff5dc9833fe7bd7ca1161d4244c3
- SHA256
  
  005d806db1872ff20a13f7a200c994eeee426a63c8512eeaffab202a1e5ea037
- SHA512
  
  17fddf5546f5a463b1db23d66924592fd76339dd2808504e828b7ccf6c599738b47a24b9ed3a0675b4c01021d05a7f92cc0421370c67e47fbf073f5665463e55
- SSDEEP
  
  768:gyhT6fJ3RzXcQ95LRMua722c3NBqE4E9nIWmwTnaCbPmyxLfXIj9:gyhu7zbJsILqdKndmwTaeHBg
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2