d9dc8934801540d9f484992bf8bdd55c36a454ece6469de322546754832d4b20 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39dfbdc595913049289f361352e20211_JaffaCakes118
Size

724KB
Sample

241012-n23ykatcrk
MD5

39dfbdc595913049289f361352e20211
SHA1

645e5d9dcf7ee54bae955229a3e4add839bad622
SHA256

d9dc8934801540d9f484992bf8bdd55c36a454ece6469de322546754832d4b20
SHA512

23792cb33d363abceff72aae812072f8e6f801338f45a16f99d49b054d6ec27539bc593b641e46415816c5012de9bf5d7bd1555c5f2eb99535f80e1912e2d690
SSDEEP

12288:Nrkv7b/IDlV7TmC6GEh5vcDe7RrW7SZFs1evzUyxwKE4nag9y8pEgK8sY6jYir:NabSyvGEfcDe7REsFv4ylRnzM7xRYir

Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer

Malware Config

Targets

- Target
  
  39dfbdc595913049289f361352e20211_JaffaCakes118
- Size
  
  724KB
- MD5
  
  39dfbdc595913049289f361352e20211
- SHA1
  
  645e5d9dcf7ee54bae955229a3e4add839bad622
- SHA256
  
  d9dc8934801540d9f484992bf8bdd55c36a454ece6469de322546754832d4b20
- SHA512
  
  23792cb33d363abceff72aae812072f8e6f801338f45a16f99d49b054d6ec27539bc593b641e46415816c5012de9bf5d7bd1555c5f2eb99535f80e1912e2d690
- SSDEEP
  
  12288:Nrkv7b/IDlV7TmC6GEh5vcDe7RrW7SZFs1evzUyxwKE4nag9y8pEgK8sY6jYir:NabSyvGEfcDe7REsFv4ylRnzM7xRYir
Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Accessibility Features

Image File Execution Options Injection

Privilege Escalation

Event Triggered Execution

Accessibility Features

Image File Execution Options Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalationspywarestealer

behavioral2

discoveryevasionpersistenceprivilege_escalationspywarestealer