6166611f9afc1eb9a3421d8d5200d7e5770fb012607be4879be4aa2b951fcf74 | Triage

Sharing

General

Target

075e429cd59099875b0afee01870f052_JaffaCakes118
Size

817KB
Sample

241001-zlyjpatcqd
MD5

075e429cd59099875b0afee01870f052
SHA1

0c2b86dfe8eeffeacd6ef0391ebd709afb19d720
SHA256

6166611f9afc1eb9a3421d8d5200d7e5770fb012607be4879be4aa2b951fcf74
SHA512

f2063e1b5bb8ad81286e98ded7fbd03fc75e894e8985b83471538fbc5aa5f84624454c703544d38a82f353ad725694188fa6afb6a351de9ad78976bb76d8865c
SSDEEP

12288:JnOnht4BmmO7QGNec+9d7OZYnNbDLiV+bRGeQ1AmixJu5k9:JnOnP2mz7QGN/KOuNvjGz1A7u5k9

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  075e429cd59099875b0afee01870f052_JaffaCakes118
- Size
  
  817KB
- MD5
  
  075e429cd59099875b0afee01870f052
- SHA1
  
  0c2b86dfe8eeffeacd6ef0391ebd709afb19d720
- SHA256
  
  6166611f9afc1eb9a3421d8d5200d7e5770fb012607be4879be4aa2b951fcf74
- SHA512
  
  f2063e1b5bb8ad81286e98ded7fbd03fc75e894e8985b83471538fbc5aa5f84624454c703544d38a82f353ad725694188fa6afb6a351de9ad78976bb76d8865c
- SSDEEP
  
  12288:JnOnht4BmmO7QGNec+9d7OZYnNbDLiV+bRGeQ1AmixJu5k9:JnOnP2mz7QGN/KOuNvjGz1A7u5k9
Score

7^/10

discovery persistence spyware stealer upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2

discoverypersistenceupx