40ccb900ce89e8dc40917598eac012f407fa0effc3c3f3fca48de0c9b56bb49c

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 17:13

Target

f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
Size

1.6MB
MD5

f86b6f2dce3ed093cec7c2e83f6b9bfa
SHA1

70ee9eae9c5a3b10de42a44bfef27161662f7bd8
SHA256

40ccb900ce89e8dc40917598eac012f407fa0effc3c3f3fca48de0c9b56bb49c
SHA512

64e17dcf304cadc4b702c5fe03637dba79d42e102d81f6288e1d5d5d568d5077b5478a30955c555c086ce76106dee27a04d513e7d71f131ecd96bcd09249968e
SSDEEP

49152:y/fwUdLfGiPTStHxNtKgEAhK1kfqtOZ2TwwrZ:ywUdCi7KHs19tcM

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
788	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
788	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
788	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
788	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
2952	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
2952	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
2952	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
2952	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2952	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe
2952	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 2952	788	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe	91
PID 788 wrote to memory of 2952	788	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe	91
PID 788 wrote to memory of 2952	788	f86b6f2dce3ed093cec7c2e83f6b9bfa_JaffaCakes118.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\pkg_11d2b1040\autorun.txt

Filesize
84B

MD5
55d5ff104ae9f3ca11ac04db1c39f1d6

SHA1
366ea506ee0b9ad96a838595927ccaac65970fb4

SHA256
1093246de9c7121ebc85152eaf3e57c564fa995064a974bca25ad8a4d9bc972d

SHA512
2ca8158d3d94779193be08b26a5a3c514cd816f4050bf0444fe8d75a59e941f54bb436a97be22249fb3364a1eee6a442907c4646afd79c8adbcd36da29ffd3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_11d2b1040\wrapper.xml

Filesize
798B

MD5
1d45a29e3511b982a1f91b33c70e964f

SHA1
176a47b489be3f27dc354a2b9dd0b580bb2f3904

SHA256
0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

SHA512
c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

Download Submit