23226398d73d479d8972b2337025242c8db86397c8f0284400cbe71661156285

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 22:01

Target

6fed82a74c070d6163e4f47fffb19981_JaffaCakes118.exe
Size

554KB
MD5

6fed82a74c070d6163e4f47fffb19981
SHA1

552003efb5079a58adb119d1ce5b30733ff9d241
SHA256

23226398d73d479d8972b2337025242c8db86397c8f0284400cbe71661156285
SHA512

356a6330cbd1eca9be43fc2df3d560bb02720053d832462df820e32a3a1370dd27d85f964e6e21c42260cd5af18e614732525f0ecc39729e0a6cd42409e9eead
SSDEEP

12288:UsLSQt0pkJ6KZ9jlkBdX2Gl45ZLRt100sa3wDhM6tpWgXrqPmRc8z:UsLS2XZ9jlch2GKZ310G3wBpqIc8z

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6fed82a74c070d6163e4f47fffb19981_JaffaCakes118.exe

description	pid	process	target process
PID 4516 wrote to memory of 1816	4516	6fed82a74c070d6163e4f47fffb19981_JaffaCakes118.exe	cmd.exe
PID 4516 wrote to memory of 1816	4516	6fed82a74c070d6163e4f47fffb19981_JaffaCakes118.exe	cmd.exe
PID 4516 wrote to memory of 1816	4516	6fed82a74c070d6163e4f47fffb19981_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6fed82a74c070d6163e4f47fffb19981_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6fed82a74c070d6163e4f47fffb19981_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\968.bat
2⤵
PID:1816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\53484.exe
Filesize
554KB

MD5
6fed82a74c070d6163e4f47fffb19981

SHA1
552003efb5079a58adb119d1ce5b30733ff9d241

SHA256
23226398d73d479d8972b2337025242c8db86397c8f0284400cbe71661156285

SHA512
356a6330cbd1eca9be43fc2df3d560bb02720053d832462df820e32a3a1370dd27d85f964e6e21c42260cd5af18e614732525f0ecc39729e0a6cd42409e9eead

Download Submit
C:\Users\Admin\AppData\Local\Temp\968.bat
Filesize
175B

MD5
8d0df30878ebccf3c8e8bae0332786cf

SHA1
6a22bf5b713903a5f84785c84df8ebd73d397795

SHA256
763183493300a465f31ede4eb8ecc0f7b95d85f2ef3771233a429ad740080a2a

SHA512
6c8eb632e1592d642e95a94b7706e31dab0020b208611899ebd2398da5606a92c561281f82f7af088d0545f9d8906e2f1416bc7fb20477a468c0013263d2c9a0

Download Submit
memory/4516-0-0x0000000010000000-0x0000000010127000-memory.dmp

Filesize
1.2MB

Download