d1c6df1bd93b59127ee32f0f37ae737e0c2b5a08da1aa3b29554e594cffddc2d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 15:27

Target

057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe
Size

652KB
MD5

057fed2e177e9c80a7db1e764abe0289
SHA1

bf384be58d4028d9f5fdd864528f0db389585a5a
SHA256

d1c6df1bd93b59127ee32f0f37ae737e0c2b5a08da1aa3b29554e594cffddc2d
SHA512

ae3190d1f0ffc099526d7f54c3fe46b74124d5f66e87f9d57f5395f33ca45cf301200f0eddb43c12d6645490498a992e8349f93a84e9362b62dea5f5ca4ce753
SSDEEP

12288:oLOVKAZ9/Rb2Bgu0crDP92LN7AmQh8rrxifeJWJRTSRKVBE7Yd:wkKApqLJCArJUeTSRQE7u

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe

description	pid	process	target process
PID 2744 wrote to memory of 2768	2744	057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe	cmd.exe
PID 2744 wrote to memory of 2768	2744	057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe	cmd.exe
PID 2744 wrote to memory of 2768	2744	057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe	cmd.exe
PID 2744 wrote to memory of 2768	2744	057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\206.bat
2⤵
PID:2768

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\206.bat
Filesize
175B

MD5
9b84b18c9a6f6396bc832426fde478e7

SHA1
85d1407fc1f376225b7c810a04d9479ab80e3d0a

SHA256
c65b2ee442e1bbf29cc3c4300bf4977b2c1c10766dcc723363828dfc2759524b

SHA512
0c5afe775b1f0d49dbde5d472d8ca9b7f2a22aaf5e4ffacf556a05d292905a3ebf7118a3cdb41533910fcd7cad3adf39552c4ea044f274529a3547c57fb4ba62

Download Submit
C:\Users\Admin\AppData\Local\Temp\93491.exe
Filesize
652KB

MD5
057fed2e177e9c80a7db1e764abe0289

SHA1
bf384be58d4028d9f5fdd864528f0db389585a5a

SHA256
d1c6df1bd93b59127ee32f0f37ae737e0c2b5a08da1aa3b29554e594cffddc2d

SHA512
ae3190d1f0ffc099526d7f54c3fe46b74124d5f66e87f9d57f5395f33ca45cf301200f0eddb43c12d6645490498a992e8349f93a84e9362b62dea5f5ca4ce753

Download Submit
memory/2744-0-0x0000000010000000-0x0000000010124000-memory.dmp

Filesize
1.1MB

Download