604f82b0aa4f6298ab4ed1a3a5488759577f06e596b33885a9937b028a889a3c

General

Target

f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe
Size

585KB
MD5

f8b263978939f6cd85ef520db5fdfb6c
SHA1

0c4bbe02edb642566ef17473807b9fa4756aadaf
SHA256

604f82b0aa4f6298ab4ed1a3a5488759577f06e596b33885a9937b028a889a3c
SHA512

ba0ba5f8f0e8ee4f87661acffd4c0f0ecf17ab797a81a38e86ff7b774e5b67a0b3201ab4d6db1beeb940a7664e43c8595c669a3a0886883f5a6f6d649ecccd39
SSDEEP

12288:SG2tzSMJb9pZ5RgY2yUNK+upN35jGFpVMbonpEPH0zEBQM1SoSbmKZ7:SPxzKtrEPo2Qfbl7

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2488	1932	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	28
PID 2488 wrote to memory of 2632	2488	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	29
PID 2488 wrote to memory of 2632	2488	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	29
PID 2488 wrote to memory of 2632	2488	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	29
PID 2488 wrote to memory of 2632	2488	f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f8b263978939f6cd85ef520db5fdfb6c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\699.bat
    3⤵
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\63485.exe

Filesize
585KB

MD5
f8b263978939f6cd85ef520db5fdfb6c

SHA1
0c4bbe02edb642566ef17473807b9fa4756aadaf

SHA256
604f82b0aa4f6298ab4ed1a3a5488759577f06e596b33885a9937b028a889a3c

SHA512
ba0ba5f8f0e8ee4f87661acffd4c0f0ecf17ab797a81a38e86ff7b774e5b67a0b3201ab4d6db1beeb940a7664e43c8595c669a3a0886883f5a6f6d649ecccd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\699.bat

Filesize
175B

MD5
a571f92147ea69ed7f52736900289a04

SHA1
3cb5d46d879b49752842245d574234f65940b08b

SHA256
acb7f2c554be8b7439d063b7752318be46c8ab584b12f12065c910e22b999dba

SHA512
876f9318c15fa90c7f6e1dff46359fb6870bba1b9fc4c0cad615dfacf2acb451f6d46779f183c1ead74a0ab1fd125b2b6f9d9b7e6d3768bae7952e7c54ab7f63

Download Submit
memory/2488-8-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-5-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-6-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-7-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-0-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-12-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-11-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-10-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-4-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-2-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-23-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2488-24-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing