495ab9b57e4d7738a7b313c258512d22d2168eedc2c53afa69408d6345669c05 | Triage

Sharing

General

Target

3b0a7b43972933a5f82d00eccc68fb46_JaffaCakes118
Size

747KB
Sample

241012-t5y2nsvbnk
MD5

3b0a7b43972933a5f82d00eccc68fb46
SHA1

c40c8ff1a4d329e32610491e152ddf509f279be5
SHA256

495ab9b57e4d7738a7b313c258512d22d2168eedc2c53afa69408d6345669c05
SHA512

cc47502048ce7758d8364b2c55885c38cfa6d6bc5adc02e146035972f663fe94a1ad65e89fd7254ef4aa3e8b15942c203c7908d83ed2db4fd63cd7eaf02ca41c
SSDEEP

12288:0U2/svcRBlQrRZAjxVPQ7zbjvuQFTmjQ8CDc8+1IJ5XD1OouTGAy2z0jesK6ix:v2/svrO5QbjvPFTmjQ8IHDUTGF2z0j1c

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Targets

- Target
  
  3b0a7b43972933a5f82d00eccc68fb46_JaffaCakes118
- Size
  
  747KB
- MD5
  
  3b0a7b43972933a5f82d00eccc68fb46
- SHA1
  
  c40c8ff1a4d329e32610491e152ddf509f279be5
- SHA256
  
  495ab9b57e4d7738a7b313c258512d22d2168eedc2c53afa69408d6345669c05
- SHA512
  
  cc47502048ce7758d8364b2c55885c38cfa6d6bc5adc02e146035972f663fe94a1ad65e89fd7254ef4aa3e8b15942c203c7908d83ed2db4fd63cd7eaf02ca41c
- SSDEEP
  
  12288:0U2/svcRBlQrRZAjxVPQ7zbjvuQFTmjQ8CDc8+1IJ5XD1OouTGAy2z0jesK6ix:v2/svrO5QbjvPFTmjQ8IHDUTGF2z0j1c
Score

7^/10

discovery persistence spyware stealer upx
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealerupx

behavioral2