9ebd86e1e9ee094853f72c3b69e3b45f06b57beac8ff4a222e0e32efd1e26cce | Triage

Sharing

General

Target

2900ebdc6509c31143d2e906c8564641_JaffaCakes118
Size

447KB
Sample

241009-cnt8qaxdne
MD5

2900ebdc6509c31143d2e906c8564641
SHA1

11d835fd29ec292f1458af5092bc9af9c79afe01
SHA256

9ebd86e1e9ee094853f72c3b69e3b45f06b57beac8ff4a222e0e32efd1e26cce
SHA512

5ba0611f9f393c43a1c0b59c6262c686944e16eb3b6f75316ae575d5a17ebefa6993f95da988e72fa0703ecdedfa22f0d0d3bcdb8810db6fb5e87d9d306f493e
SSDEEP

12288:z52k/5CJKfPZxKJpSEIP13toJrq0W55T6:drcOPuHd6puJ+P55W

Score

7^/10

credential_access discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  2900ebdc6509c31143d2e906c8564641_JaffaCakes118
- Size
  
  447KB
- MD5
  
  2900ebdc6509c31143d2e906c8564641
- SHA1
  
  11d835fd29ec292f1458af5092bc9af9c79afe01
- SHA256
  
  9ebd86e1e9ee094853f72c3b69e3b45f06b57beac8ff4a222e0e32efd1e26cce
- SHA512
  
  5ba0611f9f393c43a1c0b59c6262c686944e16eb3b6f75316ae575d5a17ebefa6993f95da988e72fa0703ecdedfa22f0d0d3bcdb8810db6fb5e87d9d306f493e
- SSDEEP
  
  12288:z52k/5CJKfPZxKJpSEIP13toJrq0W55T6:drcOPuHd6puJ+P55W
Score

7^/10

credential_access discovery persistence spyware stealer upx
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Windows Credential Manager

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoverypersistencespywarestealerupx

behavioral2