2badb3e456ffd973735aa55cdd875369cc7f5355704047d48f7604346091339e

General

Target

060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
Size

1.3MB
MD5

060c0cfbc8bc5dad4f01e63b0c605990
SHA1

d8e0e1bdca3c981170d8a456e59c4f8d8f14c42f
SHA256

2badb3e456ffd973735aa55cdd875369cc7f5355704047d48f7604346091339e
SHA512

bf493074615e5211e164228af734e2b9ab85af671bcdcbbd6d564211c60848a8b7377573ed99a058af6d4110b4cb95d382cd9129c2cc24fbd612cfa9e767e434
SSDEEP

24576:MYOOHgB6G/DXr+7ToeXO/PT2HFFAtPMBVmllzlE:MY9ABnYK2APMBVmllzG

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1518.001

Processes:

060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivir Desktop 060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivir Desktop	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

description	pid	process	target process
PID 688 set thread context of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

pid process

2516 060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
2516 060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

pid	process
2516	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
2516	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
2516	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
2516	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

description	pid	process	target process
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
PID 688 wrote to memory of 2516	688	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe	060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:688

C:\Users\Admin\AppData\Local\Temp\060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\060c0cfbc8bc5dad4f01e63b0c605990_JaffaCakes118.exe"
2⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Software Discovery

1

T1518

Security Software Discovery

1

T1518.001

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bottom.jpg
Filesize
1KB

MD5
2a02f5cfb8ab6ef8da96cb6319199ec1

SHA1
e835817901cae81eb1a88cd76b08dc00b2e27111

SHA256
24f374f557014d78b3a19a6595caabedc7e9c496bcbfca3a84f0f4ff17196225

SHA512
05313d9c0d5af986f90c3b000074037bf8399fa5d9a29b8e7c9093dd748fb8ea8d66e51d443e0a8c2aa908f59e37d6ddc49b2f62141d15cc4f1fad1aa897fa3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\header.jpg
Filesize
3KB

MD5
1fffd38bcbcddd52c8f171812c897e14

SHA1
753f8226acab4970537358973d3aa9cff789617a

SHA256
e065105abe1d41c492e6097958e497cbf120589122d15c04a0791c30f63a770f

SHA512
b092d5e2ca6623a2875b8e9005a27c189cc2ac6cdf7815f4da179d253ac0419a7ae16e96f9357b09655b843d9d71842a94d9faa62415d74df3b2bc0b643e7a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\side.jpg
Filesize
27KB

MD5
60f34e6b09d2244e5576131dc91e1631

SHA1
144183bb0d4de6ced00d2c0c0fe32bb51f744fe6

SHA256
317ccb762831c8cd4e64e45a5368ab53e34eb64b0fc09fb6cf68ddde97119c1a

SHA512
b544b05e8486e8faa581a7874a7084ed7331e499b8c68110ff2b816516c62c10b87afc01d5e782b9e534c3f209a738e13d75b94c81426830a93b6f2c18b357cd

Download Submit
memory/2516-5-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-4-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-7-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-8-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-2-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-9-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-3-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-1-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/2516-30-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads