d1c6df1bd93b59127ee32f0f37ae737e0c2b5a08da1aa3b29554e594cffddc2d

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 15:27

Target

057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe
Size

652KB
MD5

057fed2e177e9c80a7db1e764abe0289
SHA1

bf384be58d4028d9f5fdd864528f0db389585a5a
SHA256

d1c6df1bd93b59127ee32f0f37ae737e0c2b5a08da1aa3b29554e594cffddc2d
SHA512

ae3190d1f0ffc099526d7f54c3fe46b74124d5f66e87f9d57f5395f33ca45cf301200f0eddb43c12d6645490498a992e8349f93a84e9362b62dea5f5ca4ce753
SSDEEP

12288:oLOVKAZ9/Rb2Bgu0crDP92LN7AmQh8rrxifeJWJRTSRKVBE7Yd:wkKApqLJCArJUeTSRQE7u

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe

description	pid	process	target process
PID 3256 wrote to memory of 1992	3256	057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe	cmd.exe
PID 3256 wrote to memory of 1992	3256	057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe	cmd.exe
PID 3256 wrote to memory of 1992	3256	057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\057fed2e177e9c80a7db1e764abe0289_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\437.bat
2⤵
PID:1992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\437.bat
Filesize
175B

MD5
4db23ccd89d655fbc68bdaff611776ef

SHA1
e8dd4b899bfefe426441d1a50c253afc0a56faff

SHA256
2fe1a31f6047fcdc45768ea012b65c2dcb3d6ec7d879d54a08ae0f238b6b3a2b

SHA512
4659c70eb7eb850c4088706ece01803138c8d681c663c694f86f01364726b2e80dc0dc2612266d53d5b365aec2a37e58af5def7e0c27ecad7e22dbaf3006b527

Download Submit
C:\Users\Admin\AppData\Local\Temp\93491.exe
Filesize
652KB

MD5
057fed2e177e9c80a7db1e764abe0289

SHA1
bf384be58d4028d9f5fdd864528f0db389585a5a

SHA256
d1c6df1bd93b59127ee32f0f37ae737e0c2b5a08da1aa3b29554e594cffddc2d

SHA512
ae3190d1f0ffc099526d7f54c3fe46b74124d5f66e87f9d57f5395f33ca45cf301200f0eddb43c12d6645490498a992e8349f93a84e9362b62dea5f5ca4ce753

Download Submit
memory/3256-0-0x0000000010000000-0x0000000010124000-memory.dmp

Filesize
1.1MB

Download