61c45f7047777590b68b04d84635058e334b6bf40037869c8f785c2ad48ac3ec | Triage

Sharing

General

Target

451b36a07bd5ac3f4006f420cd8d6404_JaffaCakes118
Size

722KB
Sample

241015-bl7wcszfkm
MD5

451b36a07bd5ac3f4006f420cd8d6404
SHA1

77ea18b99565d17f0f120efd3bbf119fc5ae682e
SHA256

61c45f7047777590b68b04d84635058e334b6bf40037869c8f785c2ad48ac3ec
SHA512

e8b98cc48e956b57519a13d48c0f43025d5e72da3425319b3e9926f1530badca0fd6af1c7871800aa6dcffb63a35902308622c5331bfa36f216849aeddf5e48f
SSDEEP

12288:h1OgLdaOMo99/rsFEt5hDG0SAMs9jR/jeRJKu9TJdwYGZtyjTje5jOSpJj:h1OYdaOMOBsFEt5hDG0SAMs9jR/jaJn+

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  
  451b36a07bd5ac3f4006f420cd8d6404_JaffaCakes118
- Size
  
  722KB
- MD5
  
  451b36a07bd5ac3f4006f420cd8d6404
- SHA1
  
  77ea18b99565d17f0f120efd3bbf119fc5ae682e
- SHA256
  
  61c45f7047777590b68b04d84635058e334b6bf40037869c8f785c2ad48ac3ec
- SHA512
  
  e8b98cc48e956b57519a13d48c0f43025d5e72da3425319b3e9926f1530badca0fd6af1c7871800aa6dcffb63a35902308622c5331bfa36f216849aeddf5e48f
- SSDEEP
  
  12288:h1OgLdaOMo99/rsFEt5hDG0SAMs9jR/jeRJKu9TJdwYGZtyjTje5jOSpJj:h1OYdaOMOBsFEt5hDG0SAMs9jR/jaJn+
Score

7^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer