c248e72002d56fb7e23c96f86f2a70a2e746f8f5a76962e7bf7b3728b69f82d8

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe
Size 2.9MB
Sample240407-w1e44sbc33
SHA256 c248e72002d56fb7e23c96f86f2a70a2e746f8f5a76962e7bf7b3728b69f82d8
MD5 e5915e3bb70da0213631b3a6e1d0a215
SHA1 cce0c0586b2b644ec7b8a14af03df02f3dff58ba
SHA512 fe568a720a3da3f987c6e4a4d3d003699b13c73a400de3ab3d797798e2342723c382f64b010bacc6ee018af4b53145131c1843b0f2ad75b40940dfedf212725c
SSDEEP 49152:PUKvwiQmD+T6q9Ugkmn9GAXDRjmn9GAXDRrmn9GAXDRu:PUKKmD+eN0n9TAn9TUn9T8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3064	_v_24655.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4196	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	84
PID 4088 wrote to memory of 4196	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	84
PID 4088 wrote to memory of 4196	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	84
PID 4088 wrote to memory of 2196	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	86
PID 4088 wrote to memory of 2196	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	86
PID 4088 wrote to memory of 2196	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	86
PID 4088 wrote to memory of 3064	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	88
PID 4088 wrote to memory of 3064	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	88
PID 4088 wrote to memory of 3064	4088	e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5915e3bb70da0213631b3a6e1d0a215_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del _v_*
  2⤵
  PID:4196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del /windows/../../../../../../../../../_v_*
  2⤵
  PID:2196
- \??\c:\_v_24655.exe
  c:/_v_24655.exe
  2⤵
  - Executes dropped EXE
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

office2016setup.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml
Size 3.0MB
SHA256 e3dfef7946c662378da1eb28d1abd43c62f108c1ab189757f4c07da865bdc639
MD5 60117d60bcdbf1cc98f760ebb1ea5abe
SHA1 2206229f6f4f0cefeff59ee2170d7c58b96c1e92
SHA512 31394a8fa558260a858b8ad1672afc21f3909ee1445c2dba547128c272e0d62dbe2c046f89f34c205be2dcdfca4dfaa96f4bc33bd48388b5d4a5385f596ea0d7
SSDEEP 49152:PUKvwiQmD+T6q9Ugkmn9GAXDRjmn9GAXDRrmn9GAXDRt:PUKKmD+eN0n9TAn9TUn9TD
MD5 SHA1 SHA512 SSDEEP

Submit Download

_v_24655.exe

Path \??\c:\_v_24655.exe
Size 2.5MB
SHA256 609819faf9f7ae9f83f3df74d8efeb4bdab3684a65e557c5ab2dd4ec307d51de
MD5 7beeac4da4bdffd60ddec70069ae094d
SHA1 26edd73fd12e2ac9705a58a4d4d360e513f50d93
SHA512 9cb1d85f77bb0117fae41ca71c308c60f6a610a09e8a0554ed850aaba9e732d51af91441743fd5ea656b89e4d2c4918be4ff7c0c20adf8d99a0f53ccf9f2304d
SSDEEP 49152:uwiQmD+T6q9Ugkmn9GAXDRjmn9GAXDRrmn9GAXDRq:FmD+eN0n9TAn9TUn9T0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3064-4-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3064-5-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/3064-25-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/3064-28-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/3064-29-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/4088-24-0x0000000000400000-0x0000000000471000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads