General

  • Target

    fb5a837b64a5704be19c48120a480557_JaffaCakes118

  • Size

    58KB

  • Sample

    240928-c92vpavhqb

  • MD5

    fb5a837b64a5704be19c48120a480557

  • SHA1

    1fc07b7b0322b3b78a57fd9f395f5b9fe058262e

  • SHA256

    ca6b1836e355b9d55fb8a65679a781b800f29de13035fe7bd41240c578293748

  • SHA512

    63c633bddc3129b83ebc61610983a2b2c5211816c49cb8cdaea810ecbb4a1f4a12bef490145436e15af02a4a6f03f6d20589a1656963d44521f8acafb7164eef

  • SSDEEP

    1536:kiqlYmQSk3mD1hiBSXAKySZpLTBifKXDLStG:oHk3mph8k1NXBfXDLSw

Malware Config

Targets

    • Target

      fb5a837b64a5704be19c48120a480557_JaffaCakes118

    • Size

      58KB

    • MD5

      fb5a837b64a5704be19c48120a480557

    • SHA1

      1fc07b7b0322b3b78a57fd9f395f5b9fe058262e

    • SHA256

      ca6b1836e355b9d55fb8a65679a781b800f29de13035fe7bd41240c578293748

    • SHA512

      63c633bddc3129b83ebc61610983a2b2c5211816c49cb8cdaea810ecbb4a1f4a12bef490145436e15af02a4a6f03f6d20589a1656963d44521f8acafb7164eef

    • SSDEEP

      1536:kiqlYmQSk3mD1hiBSXAKySZpLTBifKXDLStG:oHk3mph8k1NXBfXDLSw

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks