18d64df909c3178cd1f25cb6cb0e214941cc3031d1b56ecabf1fdf6f8a5d8eaa

Analysis

max time kernel
94s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
Size 1.6MB
Sample240407-2d3vjsgf32
SHA256 18d64df909c3178cd1f25cb6cb0e214941cc3031d1b56ecabf1fdf6f8a5d8eaa
MD5 e6008a5aba6231eca145cd709a41b498
SHA1 b37bb40c3f7b32161be818c973adb3766dab50c2
SHA512 98be9a8f563ecd2254632dcf5ff178961eca37501713e52611a13a8f0f373d4595893d60e993ee2eae3634ec45277f497a20aeb3203d981208a57cc272b17b3d
SSDEEP 49152:0QagM/VkLHwbwexxcTcoOfhc8AxOVnbw+ij/TtChjnbIs:LEVkLAxPo0c8hB9ijSjb5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3592	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
3592	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
3592	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
3592	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
2288	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
2288	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
2288	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
2288	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2288	3592	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe	85
PID 3592 wrote to memory of 2288	3592	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe	85
PID 3592 wrote to memory of 2288	3592	e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e6008a5aba6231eca145cd709a41b498_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_161c3722e0"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_161c3722e0\autorun.txt
Size 96B
SHA256 90928af971cfef92eb43e67cb9f3942654acd5828c9b6246330af0b60e55dfd0
MD5 d6f1ae0ab2f2aa599795748a77829fae
SHA1 e1aa8d78ab5a02e2d04763fab1565abc90984e54
SHA512 e64612a30c79255d3f61531859af0d6e95f0a5838ecf181b28d55b6a46e4db7a09f04b0ca1d71acd5ddeef5aea2152862fc351130db43a446e849107964346cf
MD5 SHA1 SHA512

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_161c3722e0\wrapper.xml
Size 692B
SHA256 424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9
MD5 44601e00ff712607d2a0b64de786d843
SHA1 5696d1604b564a38669035faf395f78c933d8717
SHA512 7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1
MD5 SHA1 SHA512

Submit Download