31a49abd1c2b407df1b5dca7766a31725fe1f5ae0b73dc6e2f22b36e24d79bf8 | Triage

Sharing

General

Target

117fb58f5dbe646a53372924499de840_JaffaCakes118
Size

1022KB
Sample

241004-c6xfsstgmc
MD5

117fb58f5dbe646a53372924499de840
SHA1

14c122e9e88dd960baa8e52d3bde672e333dcd44
SHA256

31a49abd1c2b407df1b5dca7766a31725fe1f5ae0b73dc6e2f22b36e24d79bf8
SHA512

447bef79933d038dd3d4a487253a0fa5eaa6ff119b6abfd32af5a499eaffefb4aa0a795232fe01b01234e947257b00ce83adbb7bdc238d912559e81e6866d1ba
SSDEEP

12288:siNTF7cP+H6WA5uYY11WjIYjs3mWvgILI/I0qXxd4xNLn9Kg/zfgFah8/M9:39Zcu6lUzyq2WvgHqfend/Lg0h7

Score

9^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  117fb58f5dbe646a53372924499de840_JaffaCakes118
- Size
  
  1022KB
- MD5
  
  117fb58f5dbe646a53372924499de840
- SHA1
  
  14c122e9e88dd960baa8e52d3bde672e333dcd44
- SHA256
  
  31a49abd1c2b407df1b5dca7766a31725fe1f5ae0b73dc6e2f22b36e24d79bf8
- SHA512
  
  447bef79933d038dd3d4a487253a0fa5eaa6ff119b6abfd32af5a499eaffefb4aa0a795232fe01b01234e947257b00ce83adbb7bdc238d912559e81e6866d1ba
- SSDEEP
  
  12288:siNTF7cP+H6WA5uYY11WjIYjs3mWvgILI/I0qXxd4xNLn9Kg/zfgFah8/M9:39Zcu6lUzyq2WvgHqfend/Lg0h7
Score

9^/10

discovery evasion persistence spyware stealer
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Software Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealer

behavioral2