203b49b087d7da31170b87119f0218887641f2a8ef48b98c6400b2d5e10aee33

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe
Size

797KB
MD5

a3c38be04778b03fb05ab5b8f38c79c7
SHA1

70ba4935bb7451f99de3b6f0152afae917980115
SHA256

203b49b087d7da31170b87119f0218887641f2a8ef48b98c6400b2d5e10aee33
SHA512

81f634893859dec19535a881dc142327c76f107cdcb595b7eeda97b8be486c5826cee2618ee09a37c0ba131d9291440416eb5c81274db0233cdd06a28d1dd8d1
SSDEEP

24576:KTydRTZ2UFpSXADfm6S0eS6F9VL4bFKwoJS3kOpUwO5wz:KedRTYsQADfd7cOhKwoJS3kOpUwO5A

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2596	2236	a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2596	2236	a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\307.bat
  2⤵
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\307.bat

Filesize
175B

MD5
89bd7603da71ea29cb76601b6de9e46b

SHA1
bb53dfee60b1a9a9d04d9e564659ce4538646c48

SHA256
5638f510071b80e773a15db868b411f7d58df304ba7373dae22ca30eb6f49ae7

SHA512
3d1085a406074977c26b877de7b6e61f5da84112809e806da2fd005f10b9620aa6153378cbdec3a5ac18d3c22f01784158748d20c5e533305c10f6c4a303c9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\43481.exe

Filesize
797KB

MD5
a3c38be04778b03fb05ab5b8f38c79c7

SHA1
70ba4935bb7451f99de3b6f0152afae917980115

SHA256
203b49b087d7da31170b87119f0218887641f2a8ef48b98c6400b2d5e10aee33

SHA512
81f634893859dec19535a881dc142327c76f107cdcb595b7eeda97b8be486c5826cee2618ee09a37c0ba131d9291440416eb5c81274db0233cdd06a28d1dd8d1

Download Submit
memory/2236-1-0x0000000002AE0000-0x0000000002C25000-memory.dmp

Filesize
1.3MB

Download