c9a9af24c4f8f944b61c2ad4ecf5a8f6e2e0c88142a21b273cac5e6ae446f6c6

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f896923ce347e283cf0061ce76a53064_JaffaCakes118.exe
Size

1.3MB
MD5

f896923ce347e283cf0061ce76a53064
SHA1

406fde917130462b7bdcf6c2fda0cb84f000a370
SHA256

c9a9af24c4f8f944b61c2ad4ecf5a8f6e2e0c88142a21b273cac5e6ae446f6c6
SHA512

4639748e91dc7dc9a864cffbe86e45788a71bcdc97663c5c03f984c8e5bc9fe560357d59c36d3f53f665b23223233d87085c8a28a622a40a3ce239a9e458037b
SSDEEP

24576:cfQYosxhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRt+GQhSQRjGM3cmE:uo54clgLH+tkWJ0NbQhSQRjGM3cmE

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
9	api.ipify.org
20	ip-api.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4240	f896923ce347e283cf0061ce76a53064_JaffaCakes118.exe
4240	f896923ce347e283cf0061ce76a53064_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	f896923ce347e283cf0061ce76a53064_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f896923ce347e283cf0061ce76a53064_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f896923ce347e283cf0061ce76a53064_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HXwLJNuZFX8C9A553F47\478C9A553FHXwLJNuZFX\Browsers\Passwords\Passwords_Edge.txt

Filesize
426B

MD5
42fa959509b3ed7c94c0cf3728b03f6d

SHA1
661292176640beb0b38dc9e7a462518eb592d27d

SHA256
870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00

SHA512
7def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007

Download Submit
C:\Users\Admin\AppData\Local\Temp\HXwLJNuZFX8C9A553F47\478C9A553FHXwLJNuZFX\Grabber\ShowMount.png

Filesize
835KB

MD5
e9a2c2ae5f365b08eda17cdb59c71fa6

SHA1
00cdcada206af856fb3077d6ba9812088e169bb1

SHA256
9f5b90f833353fd6640fdb4b82dc30a70b012fdcce1e3cdfb7b2ed4340924b6a

SHA512
9cd8d3adf75a5ef7fc2a91b635f2bbaaa765da20bc4fe0fce51259a02b699c6eccae87d585bd497902f8505c2f4bfda6b15586ce741f2a8149e77a700e8d36b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\HXwLJNuZFX8C9A553F47\478C9A553FHXwLJNuZFX\Grabber\UninstallGroup.doc

Filesize
1.1MB

MD5
9ed3060007d6a65c8fb89c4e546d4d77

SHA1
08bc1ac704bd54aad627e7aa8c245219e31f9812

SHA256
6ed9cbb61189f1e19c1c2b2bf1d77a10a96d2c391ec5049bee824605a737fc9e

SHA512
95a9f2017fa6934ca49c4f29b11dd2d7644571165837a01704a0b58aa98ac81cc878a7c6679a30be1efa80a3d01480241f5462921ac5f412e19e7067796b5de9

Download Submit
memory/4240-0-0x000002A5B50C0000-0x000002A5B520C000-memory.dmp

Filesize
1.3MB

Download
memory/4240-1-0x00007FF9D67C0000-0x00007FF9D7281000-memory.dmp

Filesize
10.8MB

Download
memory/4240-3-0x000002A5CF630000-0x000002A5CF640000-memory.dmp

Filesize
64KB

Download
memory/4240-2-0x000002A5CF640000-0x000002A5CF6B6000-memory.dmp

Filesize
472KB

Download
memory/4240-83-0x00007FF9D67C0000-0x00007FF9D7281000-memory.dmp

Filesize
10.8MB

Download