29d5df0dc22be430b7a4bab7ed998d3ad3b91dad30e1ddc1261a25c2cf34e4e9

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92d3880f472cdeb4f605884c90c19670_JaffaCakes118.exe
Size 3.2MB
Sample240603-2d8qsscc25
SHA256 29d5df0dc22be430b7a4bab7ed998d3ad3b91dad30e1ddc1261a25c2cf34e4e9
MD5 92d3880f472cdeb4f605884c90c19670
SHA1 8cf1469f53f00f5fa3eed1ecd2073fa74dc43b15
SHA512 cfc5c3d2ab070b3091b3caf9c457a1eae5633aacd35b7e03d334fabbf9f2a97cac51ede4f9d7f01fbcbdee38884aa9d0208f61ab7c471ba759946945e543b0c6
SSDEEP 24576:y7hGkTPwXZNFxhDWjMGRtAXauShVHYJ2XefUVWYMFJxGlvVXbSd0+WLNV+ZWjj4a:mkX/BDoAXauwHr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2708	Sdat.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4688	3100	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2708	3100	92d3880f472cdeb4f605884c90c19670_JaffaCakes118.exe	85
PID 3100 wrote to memory of 2708	3100	92d3880f472cdeb4f605884c90c19670_JaffaCakes118.exe	85
PID 3100 wrote to memory of 2708	3100	92d3880f472cdeb4f605884c90c19670_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\92d3880f472cdeb4f605884c90c19670_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92d3880f472cdeb4f605884c90c19670_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Roaming\Sdat.exe
  C:\Users\Admin\AppData\Roaming\Sdat.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 796
  2⤵
  - Program crash
  PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3100 -ip 3100
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vlmilolzyg24060.col

Path C:\Users\Admin\AppData\Local\Temp\vlmilolzyg24060.col
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sdat.exe

Path C:\Users\Admin\AppData\Roaming\Sdat.exe
Size 593KB
SHA256 9283db517e38dd0aeec3000b7aeaac811857daaf4a82fdcf5d74a007a27b6d5b
MD5 5c64db7cafeaa60e142cf4e128440e90
SHA1 2845183f74a598a4166ff5c75504367bceb0ee60
SHA512 d7c5063774c1a70f954a5682308ab0963ccd6c1f417d0e3a39248228b2b7d6b2d15758065897a0d202b985ea8bf37df383f920defa7ed829222fd8847f7fea78
SSDEEP 12288:+/fQmrqZh1apumMATyKn6k7anQQ/uPqJFJ6ACjLY60aZHITCZqEcFp3QxVJ/:aQIqhakmlDn9WnQQ/iqXJ6ACjs60apIY
MD5 SHA1 SHA512 SSDEEP