21e9735d52935d0b6a0e393e33edd30b204fd0e2820ca63d9a5627f40e87c077

Analysis

max time kernel
145s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 17:47

Target

606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe
Size

1.7MB
MD5

606496755aa0a7ace534414b9341e80b
SHA1

c67caf0ecf1134821aacd45d8ecb0a0d8fb9eb82
SHA256

21e9735d52935d0b6a0e393e33edd30b204fd0e2820ca63d9a5627f40e87c077
SHA512

e99e645e19d40d520530fdb2cba7637848e8e428da0f0abeb7857bcda58c9691be49f9c62656e5cfd8b30e9a73ecc0fe208f5bc81b4ac1109b9b0763b00f6be3
SSDEEP

49152:HhW51snc+LNeQTYZgAX/mGRoABjkeGGGWghV:BW51sc+LIQNAX/PBB2V

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2980 set thread context of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2096	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2096	2980	606496755aa0a7ace534414b9341e80b_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2096-0-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-2-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-14-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2096-10-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-8-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-6-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-4-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-16-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-18-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-19-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-20-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2096-21-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download