d0bb50e2b173d13dfac4e0726756ac6f715c649354a9d93aa50800dfb7898486

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe
Size 935KB
Sample240603-nnyfxsec56
SHA256 d0bb50e2b173d13dfac4e0726756ac6f715c649354a9d93aa50800dfb7898486
MD5 91a0aed5a3bbb0898fb7a81d7ad673bb
SHA1 461cfc18c50fe763bc1da7154fb5e5f8e0053f3a
SHA512 05387fda59479a4641fe3eee6cbc8d24388cc573a268455d535cd343e106845191bbb977f1f02e8355ade0e53a828d0822b50ffa9deeed126e736f1552e01133
SSDEEP 24576:bID6QudHAV1pJCDYFgYfgNvWexE9MoAhMjcSpZscrW:s5udHABJeY6YfgNvPEaTMUca
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3352	91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe
3352	91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3352	91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe
3352	91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe
3352	91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe
3352	91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91a0aed5a3bbb0898fb7a81d7ad673bb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bottom.jpg

Path C:\Users\Admin\AppData\Local\Temp\bottom.jpg
Size 1KB
SHA256 24f374f557014d78b3a19a6595caabedc7e9c496bcbfca3a84f0f4ff17196225
MD5 2a02f5cfb8ab6ef8da96cb6319199ec1
SHA1 e835817901cae81eb1a88cd76b08dc00b2e27111
SHA512 05313d9c0d5af986f90c3b000074037bf8399fa5d9a29b8e7c9093dd748fb8ea8d66e51d443e0a8c2aa908f59e37d6ddc49b2f62141d15cc4f1fad1aa897fa3d
MD5 SHA1 SHA512

Submit Download

header.jpg

Path C:\Users\Admin\AppData\Local\Temp\header.jpg
Size 3KB
SHA256 e065105abe1d41c492e6097958e497cbf120589122d15c04a0791c30f63a770f
MD5 1fffd38bcbcddd52c8f171812c897e14
SHA1 753f8226acab4970537358973d3aa9cff789617a
SHA512 b092d5e2ca6623a2875b8e9005a27c189cc2ac6cdf7815f4da179d253ac0419a7ae16e96f9357b09655b843d9d71842a94d9faa62415d74df3b2bc0b643e7a8d
MD5 SHA1 SHA512

Submit Download

side.jpg

Path C:\Users\Admin\AppData\Local\Temp\side.jpg
Size 27KB
SHA256 317ccb762831c8cd4e64e45a5368ab53e34eb64b0fc09fb6cf68ddde97119c1a
MD5 60f34e6b09d2244e5576131dc91e1631
SHA1 144183bb0d4de6ced00d2c0c0fe32bb51f744fe6
SHA512 b544b05e8486e8faa581a7874a7084ed7331e499b8c68110ff2b816516c62c10b87afc01d5e782b9e534c3f209a738e13d75b94c81426830a93b6f2c18b357cd
SSDEEP 384:8IXcv5LyuczCRpHHeqj90iwHcvR/P5UUqHAZvwDtlhH6sTB7K0DqiBCX3snQ:8IMvE6+qjvZ/P5UUqgNwt6slDqiIXAQ
MD5 SHA1 SHA512 SSDEEP

Submit Download