e9421dd27d5e70c22ddd73ecbe8eca0b1ec2c806a151046c17057b1ecfb42a46 | Triage

Sharing

General

Target

0844a79bd8d40f37556ad3046fd2b341_JaffaCakes118
Size

131KB
Sample

241002-byqgvavakf
MD5

0844a79bd8d40f37556ad3046fd2b341
SHA1

66716eddf3bd853aa43b09347860367558041a61
SHA256

e9421dd27d5e70c22ddd73ecbe8eca0b1ec2c806a151046c17057b1ecfb42a46
SHA512

bad2c35e19843052617fdfd3265acc43fb64f762957e9dcabca4ed28254a170a6ef3f8cd428bbf515d0256afc19894216d81b11628489e882f93c864a164d4fe
SSDEEP

3072:8uAnQYiBvZrZU+u9tpjU11NlDELjA/yMg0xDPFiGGasCLy:QnXKrZ/Vj3ye3XrFdsCLy

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  0844a79bd8d40f37556ad3046fd2b341_JaffaCakes118
- Size
  
  131KB
- MD5
  
  0844a79bd8d40f37556ad3046fd2b341
- SHA1
  
  66716eddf3bd853aa43b09347860367558041a61
- SHA256
  
  e9421dd27d5e70c22ddd73ecbe8eca0b1ec2c806a151046c17057b1ecfb42a46
- SHA512
  
  bad2c35e19843052617fdfd3265acc43fb64f762957e9dcabca4ed28254a170a6ef3f8cd428bbf515d0256afc19894216d81b11628489e882f93c864a164d4fe
- SSDEEP
  
  3072:8uAnQYiBvZrZU+u9tpjU11NlDELjA/yMg0xDPFiGGasCLy:QnXKrZ/Vj3ye3XrFdsCLy
Score

7^/10

discovery persistence spyware stealer upx
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2