35732f1253048f67fb99778886b3e09e810359f7184dba7a92308fb836f2166f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

271b7667747acd20518b3742eb7314e9_JaffaCakes118
Size

933KB
Sample

241008-3kgrbsyelm
MD5

271b7667747acd20518b3742eb7314e9
SHA1

8c37d8b5db776f3d7ebe0b3288bc1a7505d9ea55
SHA256

35732f1253048f67fb99778886b3e09e810359f7184dba7a92308fb836f2166f
SHA512

e38ac8f5da19f9c411c0cfc176738b4b8c9d2978efd49ef5b7db750ba75ea38a55f4ea4b843720d75d2d4ae9428b754d3b7af11c43d41b163ab272ac00d82f71
SSDEEP

24576:Q96H0nMbo7JXTDBIifqFuLE6Ehg7mM+M6uTGmA0UTPa+:dH4sCRT9qF+0g7mM+M63n0UTD

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  271b7667747acd20518b3742eb7314e9_JaffaCakes118
- Size
  
  933KB
- MD5
  
  271b7667747acd20518b3742eb7314e9
- SHA1
  
  8c37d8b5db776f3d7ebe0b3288bc1a7505d9ea55
- SHA256
  
  35732f1253048f67fb99778886b3e09e810359f7184dba7a92308fb836f2166f
- SHA512
  
  e38ac8f5da19f9c411c0cfc176738b4b8c9d2978efd49ef5b7db750ba75ea38a55f4ea4b843720d75d2d4ae9428b754d3b7af11c43d41b163ab272ac00d82f71
- SSDEEP
  
  24576:Q96H0nMbo7JXTDBIifqFuLE6Ehg7mM+M6uTGmA0UTPa+:dH4sCRT9qF+0g7mM+M63n0UTD
Score

7^/10

discovery persistence spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer