3debd019d8652b3cd66d8efffd2464a89f01d5bc8b9f70d4b3bc2e15a2995298

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 10:54

Target

f357a875aa4288a96dffaaa4c0aec290_JaffaCakes118.exe
Size

671KB
MD5

f357a875aa4288a96dffaaa4c0aec290
SHA1

1c446036cb0e89f5c8861ce49b8e774e5586f5b4
SHA256

3debd019d8652b3cd66d8efffd2464a89f01d5bc8b9f70d4b3bc2e15a2995298
SHA512

969cecbf2cc44e6983f6d4b53bbd0b2ae852040462dd0681bfe4958ad98cead885e8beb02a46a972c4cbbe65c70dc5ff5eb28ede2aa3d3eb6303b2f6142cc629
SSDEEP

12288:Ie7juwDzvwnnjuWMAVwJwoQoS+lG7W5+gWE2qhdYxgddxFFipVqS5LJpNb5qQPpf:IelDz6njuWRw2joS+U4p3h2xudxFFi6W

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2084	f357a875aa4288a96dffaaa4c0aec290_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2084	f357a875aa4288a96dffaaa4c0aec290_JaffaCakes118.exe
2084	f357a875aa4288a96dffaaa4c0aec290_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\truste.jpg

Filesize
5KB

MD5
1959eb33004d6107d3412e109c37b742

SHA1
59c3a787483e7743d5b805cd36726a0bec7e4992

SHA256
e60a764cd4d721c9fd261555510c51c668d112a37f2da2f0be1da6dceaa5f8ad

SHA512
238724a6b809d371c6ebab6057c61019e48caf7dd3245c6dca77efb5c015703a206472a9b82f778114c8dce3f10dd13fba972644b137020e4e5507053358e68e

Download Submit