2d8e9b76ce946ef521987f5965e35b5755ecfac3ccaa939113459d025e7441e3

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e63c7f2e02fc1fe157a2638f6c7d5d3d_JaffaCakes118.exe
Size 597KB
Sample240408-a2fldabe7t
SHA256 2d8e9b76ce946ef521987f5965e35b5755ecfac3ccaa939113459d025e7441e3
MD5 e63c7f2e02fc1fe157a2638f6c7d5d3d
SHA1 57711446acd6f1ae7c49a92668eb1391d231f451
SHA512 1516eeb7c8eeaeb2a2c6ef09e690a8d2a5222862a93e381fcc80e5bf870c1d2f7380fdacfb7c9cdde3465e15e0b053915770472a60b4db9e7637d41136f07691
SSDEEP 12288:5kbqHlPEFmm1OKmRrsPxS1pWyJxsQlUT19sMJxNfWN3hf6y:SboRBR4U1FsQluUyY3hf1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1144	4648	e63c7f2e02fc1fe157a2638f6c7d5d3d_JaffaCakes118.exe	96
PID 4648 wrote to memory of 1144	4648	e63c7f2e02fc1fe157a2638f6c7d5d3d_JaffaCakes118.exe	96
PID 4648 wrote to memory of 1144	4648	e63c7f2e02fc1fe157a2638f6c7d5d3d_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\e63c7f2e02fc1fe157a2638f6c7d5d3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e63c7f2e02fc1fe157a2638f6c7d5d3d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\390.bat
  2⤵
  PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

390.bat

Path C:\Users\Admin\AppData\Local\Temp\390.bat
Size 175B
SHA256 801d4ff9541eacfbcf552a9857cd0cd141dd3d988f9a77a719c0fb7b552eea58
MD5 f629c564e578f2b6a8b1e75692a55d5e
SHA1 c5167ed3339b6913b3159e64aa3c47e67ebe9bf0
SHA512 140b709b85ace340c771140efaef30059dbb22d4db608227719e417c08c7ba2de5b2fbe2ff979f1a4211602feadfe72e0f5b9196c4b8f2a1b64a90c0ea69fb71
MD5 SHA1 SHA512

Submit Download

43559.exe

Path C:\Users\Admin\AppData\Local\Temp\43559.exe
Size 597KB
SHA256 2d8e9b76ce946ef521987f5965e35b5755ecfac3ccaa939113459d025e7441e3
MD5 e63c7f2e02fc1fe157a2638f6c7d5d3d
SHA1 57711446acd6f1ae7c49a92668eb1391d231f451
SHA512 1516eeb7c8eeaeb2a2c6ef09e690a8d2a5222862a93e381fcc80e5bf870c1d2f7380fdacfb7c9cdde3465e15e0b053915770472a60b4db9e7637d41136f07691
SSDEEP 12288:5kbqHlPEFmm1OKmRrsPxS1pWyJxsQlUT19sMJxNfWN3hf6y:SboRBR4U1FsQluUyY3hf1
MD5 SHA1 SHA512 SSDEEP