a3ca4fd96ad2c12e4a177c46f58ce61d24df2e32519ef0ecfbfa02b32c17af37 | Triage

Sharing

General

Target

3bcbc1470f09d75ed49a2158a255414c_JaffaCakes118
Size

725KB
Sample

241012-yl61dsydmd
MD5

3bcbc1470f09d75ed49a2158a255414c
SHA1

44a34f6de31bf40f507474a7f068c49c3116e2b9
SHA256

a3ca4fd96ad2c12e4a177c46f58ce61d24df2e32519ef0ecfbfa02b32c17af37
SHA512

f533623c7552842056225fe2b1eaa7c269cef1c98588767469ec971c6e7ff7560996ddbca1922876ca17cc21bda76b70dc3b1d70db83624a11e0ab2fc133f458
SSDEEP

12288:h1OgLdaOeo99/rsFEt5hDG0SAMs9jR/jeRJKu9TJdwYGZtyjTje5jOSpJV:h1OYdaOeOBsFEt5hDG0SAMs9jR/jaJns

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  3bcbc1470f09d75ed49a2158a255414c_JaffaCakes118
- Size
  
  725KB
- MD5
  
  3bcbc1470f09d75ed49a2158a255414c
- SHA1
  
  44a34f6de31bf40f507474a7f068c49c3116e2b9
- SHA256
  
  a3ca4fd96ad2c12e4a177c46f58ce61d24df2e32519ef0ecfbfa02b32c17af37
- SHA512
  
  f533623c7552842056225fe2b1eaa7c269cef1c98588767469ec971c6e7ff7560996ddbca1922876ca17cc21bda76b70dc3b1d70db83624a11e0ab2fc133f458
- SSDEEP
  
  12288:h1OgLdaOeo99/rsFEt5hDG0SAMs9jR/jeRJKu9TJdwYGZtyjTje5jOSpJV:h1OYdaOeOBsFEt5hDG0SAMs9jR/jaJns
Score

7^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer