22c23853f493dd0bd627cb09c1cfef3f0858773fa3c49678a7291af6ae13dc56

General

Target

78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
Size

1.0MB
MD5

78479a2b8719d74f45a9a3526e2c07d5
SHA1

eb8bb39490dc3a6058f145a524bbff3f7f1dad0b
SHA256

22c23853f493dd0bd627cb09c1cfef3f0858773fa3c49678a7291af6ae13dc56
SHA512

d20b6837c7d76e3456f297fab52c63cf7fb94a9355f3b8015bcd9d2c161b22eaa20883b68f4dca734d7fb968840307c4e52e3e16a7bf21ebf117bef8afdc8e08
SSDEEP

24576:I5zsezvLMJC+eGekJexWkm8JIDqVraNiAgi4CICr83G9ERT/49:yrkvtex9m8J2qVraNJgi4CICrWG9ERTq

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

description	pid	process	target process
PID 2020 set thread context of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

pid process

2684 78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

pid	process
2684	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
2684	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
2684	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
2684	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

description	pid	process	target process
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
PID 2020 wrote to memory of 2684	2020	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe	78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\78479a2b8719d74f45a9a3526e2c07d5_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-8-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-10-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-16-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-17-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-6-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-4-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-14-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-3-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-19-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-20-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2684-21-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads