General

  • Target

    1c2767c6fab4a6c25d55b8d2bcb254a4_JaffaCakes118

  • Size

    67KB

  • Sample

    240701-xrjxdaxhpp

  • MD5

    1c2767c6fab4a6c25d55b8d2bcb254a4

  • SHA1

    f0dab5c6cce38548b061b4ea7f3fc2b5679e0b9e

  • SHA256

    e02debd6080b3d895b3b918fd82cb7469d0dde3109cafdd1ea737d9c4c64fc20

  • SHA512

    fc0c710611ef1718487035e7d6d1bf456a39842b0599c208634fdc4017865a9c1ec132b3858fcea9a6a9799a61ae9c77de0c30d7376345b9e2c4daff4998e27e

  • SSDEEP

    1536:bSqlQcJsYEe5TzQOTTtXVM2uOPZMrREdp:r3JsYp10EE2Varm

Malware Config

Targets

    • Target

      1c2767c6fab4a6c25d55b8d2bcb254a4_JaffaCakes118

    • Size

      67KB

    • MD5

      1c2767c6fab4a6c25d55b8d2bcb254a4

    • SHA1

      f0dab5c6cce38548b061b4ea7f3fc2b5679e0b9e

    • SHA256

      e02debd6080b3d895b3b918fd82cb7469d0dde3109cafdd1ea737d9c4c64fc20

    • SHA512

      fc0c710611ef1718487035e7d6d1bf456a39842b0599c208634fdc4017865a9c1ec132b3858fcea9a6a9799a61ae9c77de0c30d7376345b9e2c4daff4998e27e

    • SSDEEP

      1536:bSqlQcJsYEe5TzQOTTtXVM2uOPZMrREdp:r3JsYp10EE2Varm

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks