e93f1df598ffe65a6c54e1ee23a1724dcb2650b1d9fc8d014a7b95daac524c47 | Triage

Sharing

General

Target

2a63985e8d14fb1a4e307c856ec4216d_JaffaCakes118
Size

208KB
Sample

241009-eg1g9sxeqf
MD5

2a63985e8d14fb1a4e307c856ec4216d
SHA1

b529438545cca1926f841b4aa7392128edfac508
SHA256

e93f1df598ffe65a6c54e1ee23a1724dcb2650b1d9fc8d014a7b95daac524c47
SHA512

e0ff6b3f3610528d47d6ce72875f41de45909df7e2f7dffe6890eaf319c27152ea98e163eb61dbb5733f9cbfd05598bfe7b862ee1f5b3f3cb88a1f4e7c354b5f
SSDEEP

3072:C5qy0vlq6Gw2JLSCABY6Y0kqN1DnDKAwrL9NydX0yu:CBVwALHv6YU1DDYrL9NydO

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2a63985e8d14fb1a4e307c856ec4216d_JaffaCakes118
- Size
  
  208KB
- MD5
  
  2a63985e8d14fb1a4e307c856ec4216d
- SHA1
  
  b529438545cca1926f841b4aa7392128edfac508
- SHA256
  
  e93f1df598ffe65a6c54e1ee23a1724dcb2650b1d9fc8d014a7b95daac524c47
- SHA512
  
  e0ff6b3f3610528d47d6ce72875f41de45909df7e2f7dffe6890eaf319c27152ea98e163eb61dbb5733f9cbfd05598bfe7b862ee1f5b3f3cb88a1f4e7c354b5f
- SSDEEP
  
  3072:C5qy0vlq6Gw2JLSCABY6Y0kqN1DnDKAwrL9NydX0yu:CBVwALHv6YU1DDYrL9NydO
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer