739e8e424e8a3bf082fdca40207caaf67cc3b1d76b41744902b8142497a3c56b | Triage

Sharing

General

Target

4114fb6bc2ba49dd5af753063e888f35_JaffaCakes118
Size

191KB
Sample

241013-vqym2axgpb
MD5

4114fb6bc2ba49dd5af753063e888f35
SHA1

884fccf4f3c9e0fb966619ed2b2da5a463fb9284
SHA256

739e8e424e8a3bf082fdca40207caaf67cc3b1d76b41744902b8142497a3c56b
SHA512

9e04e9d579624181eda5c055f448ec68286bc22ef8ffcc715b1f3f9a3622b83adee6da478a924723f5c5fa8aafc89b55eba3de6f4e634f2761cbcb81c9040622
SSDEEP

3072:22j0wLl/EC8sW89i+6X367jtTgFhN7IrwsBcxeXBYcxfW9ask+hfebTtqEos8U4j:22j0cl8C8sWj+6X36vtTEN7QL51GasVj

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  4114fb6bc2ba49dd5af753063e888f35_JaffaCakes118
- Size
  
  191KB
- MD5
  
  4114fb6bc2ba49dd5af753063e888f35
- SHA1
  
  884fccf4f3c9e0fb966619ed2b2da5a463fb9284
- SHA256
  
  739e8e424e8a3bf082fdca40207caaf67cc3b1d76b41744902b8142497a3c56b
- SHA512
  
  9e04e9d579624181eda5c055f448ec68286bc22ef8ffcc715b1f3f9a3622b83adee6da478a924723f5c5fa8aafc89b55eba3de6f4e634f2761cbcb81c9040622
- SSDEEP
  
  3072:22j0wLl/EC8sW89i+6X367jtTgFhN7IrwsBcxeXBYcxfW9ask+hfebTtqEos8U4j:22j0cl8C8sWj+6X36vtTEN7QL51GasVj
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2