9d35a2153846ecea71060d69014279cb526f8b432913d02759c5023a81c62d59

Analysis

max time kernel
162s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fc5f085acfa0071db7d7ecaca696650_JaffaCakes118.exe
Size

1.3MB
MD5

5fc5f085acfa0071db7d7ecaca696650
SHA1

a756cd5b994f5afe33a4692352bae57a9f5313a3
SHA256

9d35a2153846ecea71060d69014279cb526f8b432913d02759c5023a81c62d59
SHA512

83c46365757b7f17f97409c2b8c55ab2bdb548b58ae5472d17568a0d2caa3d37f11e8e99d756043ca8e359b788394d92d7c6f98145d0f8c18fcd4fd1839d7be9
SSDEEP

24576:nkg6rJg7+sAKWHUUuxRfAmBJOQEhP4v4qLq/nbFtU+a1Svk7t:nulgSsAtHUdTzOQoP0Lq/xh9vkZ

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com

flow	ioc
3	ip-api.com

C:\Users\Admin\AppData\Local\Temp\5fc5f085acfa0071db7d7ecaca696650_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fc5f085acfa0071db7d7ecaca696650_JaffaCakes118.exe"
1⤵
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads