a70d3a168878fbe10cd15af5ea32a3c8fedd7b16cfa0374ce05dfbc22b393507 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3ddfce649d9216a80884bbb74813eb5f_JaffaCakes118
Size

724KB
Sample

241013-fejx6szdjh
MD5

3ddfce649d9216a80884bbb74813eb5f
SHA1

16bee821fd9bd402f66a8d475a9684fca31ea754
SHA256

a70d3a168878fbe10cd15af5ea32a3c8fedd7b16cfa0374ce05dfbc22b393507
SHA512

120f49c336b1a50c65380ff838242fa6ab6f2576ba9dda798def791d12571eb5009bc77b10f9a0a574e8eb66b7aa6096df2a4d1005b9a1e80132a0be36ab0bc2
SSDEEP

12288:XFulGny4rR26afLG0Fe028W4waITqSFFFFXch0r52s0ds0/rCZFqoW2wcWillGyY:XsUHR2tLFS8/RufFFFFXcu4dlrCWoXJ8

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  3ddfce649d9216a80884bbb74813eb5f_JaffaCakes118
- Size
  
  724KB
- MD5
  
  3ddfce649d9216a80884bbb74813eb5f
- SHA1
  
  16bee821fd9bd402f66a8d475a9684fca31ea754
- SHA256
  
  a70d3a168878fbe10cd15af5ea32a3c8fedd7b16cfa0374ce05dfbc22b393507
- SHA512
  
  120f49c336b1a50c65380ff838242fa6ab6f2576ba9dda798def791d12571eb5009bc77b10f9a0a574e8eb66b7aa6096df2a4d1005b9a1e80132a0be36ab0bc2
- SSDEEP
  
  12288:XFulGny4rR26afLG0Fe028W4waITqSFFFFXch0r52s0ds0/rCZFqoW2wcWillGyY:XsUHR2tLFS8/RufFFFFXcu4dlrCWoXJ8
Score

7^/10

discovery spyware stealer persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoverypersistencespywarestealer