21ece513b1f0421d929d9feff90655ddd9b4b0889add6cd89dc0ad424b82181a

Analysis

max time kernel
138s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 12:43

Target

ed7321afcddecda885d926034017afd8_JaffaCakes118.exe
Size

669KB
MD5

ed7321afcddecda885d926034017afd8
SHA1

71377c12bd10400dfb58692233e8d96178148e24
SHA256

21ece513b1f0421d929d9feff90655ddd9b4b0889add6cd89dc0ad424b82181a
SHA512

40e97895b6073ef21800788e83ac47eb998727f177a6cf79676f4397ec023d745f9fce64dbf565bace132f59c6e81c74e0fadf34018bed67f1df878e2e52aa1e
SSDEEP

12288:LexhH6HiUVUEPVCWpj7Vy5bwmF6KpvoI+QcGcf7S5DGbJpWUeVGx:LuV6HiUVTPVCWuwmFNvoI7cjSdGOUq4

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
932	ed7321afcddecda885d926034017afd8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
932	ed7321afcddecda885d926034017afd8_JaffaCakes118.exe
932	ed7321afcddecda885d926034017afd8_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\truste.jpg

Filesize
5KB

MD5
1959eb33004d6107d3412e109c37b742

SHA1
59c3a787483e7743d5b805cd36726a0bec7e4992

SHA256
e60a764cd4d721c9fd261555510c51c668d112a37f2da2f0be1da6dceaa5f8ad

SHA512
238724a6b809d371c6ebab6057c61019e48caf7dd3245c6dca77efb5c015703a206472a9b82f778114c8dce3f10dd13fba972644b137020e4e5507053358e68e

Download Submit