05b9b42be478a79e6b06a61db08145d2ceda69678733192418f9eb6bfd458668 | Triage

Sharing

General

Target

3a00617215d9016cdf3a79bd21be4b4d_JaffaCakes118
Size

724KB
Sample

241012-plv4fszfrd
MD5

3a00617215d9016cdf3a79bd21be4b4d
SHA1

b0096448d2784a6c50314593d07cb536e57ab537
SHA256

05b9b42be478a79e6b06a61db08145d2ceda69678733192418f9eb6bfd458668
SHA512

93d3fcfaa446b7d151f9288afcb10d59f99807457841cdb2ba0971ae22b02931b3115eedb662ba0e9a83ba15ca417405cf4be217409bcf2a663c2c430ed4c57d
SSDEEP

12288:h1OgLdaORo99/rsFEt5hDG0SAMs9jR/jeRJKu9TJdwYGZtyjTje5jOSpJy:h1OYdaOROBsFEt5hDG0SAMs9jR/jaJnr

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  3a00617215d9016cdf3a79bd21be4b4d_JaffaCakes118
- Size
  
  724KB
- MD5
  
  3a00617215d9016cdf3a79bd21be4b4d
- SHA1
  
  b0096448d2784a6c50314593d07cb536e57ab537
- SHA256
  
  05b9b42be478a79e6b06a61db08145d2ceda69678733192418f9eb6bfd458668
- SHA512
  
  93d3fcfaa446b7d151f9288afcb10d59f99807457841cdb2ba0971ae22b02931b3115eedb662ba0e9a83ba15ca417405cf4be217409bcf2a663c2c430ed4c57d
- SSDEEP
  
  12288:h1OgLdaORo99/rsFEt5hDG0SAMs9jR/jeRJKu9TJdwYGZtyjTje5jOSpJy:h1OYdaOROBsFEt5hDG0SAMs9jR/jaJnr
Score

7^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer