15da4a08410ae3a5e57a7c1abfdd8a4088879b0a04c3435c823bc855419ff863

General

Target
a63b7d62934f14d9acf54db16f780c9d_JaffaCakes118.exe
Size 828KB
Sample240613-srkfpayclk
SHA256 15da4a08410ae3a5e57a7c1abfdd8a4088879b0a04c3435c823bc855419ff863
MD5 a63b7d62934f14d9acf54db16f780c9d
SHA1 23cd72d8e14a4442f6aaed2c1cadd0c4c37786b6
SHA512 5afda3e2985b2137661a8ee97c1dcad36d0daa5533252dfe15ff06a40ea466651ad86f956e906c133a324e5c5747228a315db0f8c2addd7ced7b682ff15eb7a4
SSDEEP 24576:IcsLj/Zgic/t+CrxLevxJvMIjAKWw9T8PW:fQj/ZFcVaxwtw9YPW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4476	sP1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik\162\manifest.json	sP1.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik\162\manifest.json	sP1.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik\162\manifest.json	sP1.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik\162\manifest.json	sP1.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik\162\manifest.json	sP1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4476	3252	a63b7d62934f14d9acf54db16f780c9d_JaffaCakes118.exe	82
PID 3252 wrote to memory of 4476	3252	a63b7d62934f14d9acf54db16f780c9d_JaffaCakes118.exe	82
PID 3252 wrote to memory of 4476	3252	a63b7d62934f14d9acf54db16f780c9d_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\a63b7d62934f14d9acf54db16f780c9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a63b7d62934f14d9acf54db16f780c9d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\304574df\sP1.exe
  "C:\Users\Admin\AppData\Local\Temp/304574df/sP1.exe"
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pemu.js

Path C:\Users\Admin\AppData\Local\Temp\304574df\pnnfemgpilpdaojpnkjdgfgbnnjojfik\Pemu.js
Size 24KB
SHA256 ff2ddc2df2e597771aefd6dd9c086b0664b44c534c555b3e681a76548f299771
MD5 42742e7f276e7edc64936043599aa6c1
SHA1 c034bf47e01fb7b67fe6a0ea092e349a45e173c5
SHA512 eaf210c57cb99811f59ca8a4df57361d2c8838898dfd18bbb726e423c25d6c54a1036e2cc86a8db81029baedccc4ceb52ae66a583967ad14cd873b13c976bef0
SSDEEP 768:8d/LeUQVFoBsAjcy/c+5oIrhmJ+6vhd5ugYyyAZIo7Nav:q/yUQVFmjcyU+5oIrhmJ+6pDZHyAZIos
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\304574df\pnnfemgpilpdaojpnkjdgfgbnnjojfik\background.html
Size 141B
SHA256 f9b3fa78409e6006294e04099e6e9226a4605ab3abbf5b6d87e11b2e8b71b837
MD5 913be7b13bf021cbda5ddf44fec2a2b4
SHA1 51f48e8eb6c52c16c44a07d980e53e266c96d2be
SHA512 0ab75df023b5acc72b129301a899f2bfe024de30a4a0f10765b92999b80b7707d0e3e8ad08a490852bec325cc4f5fc1a6b60960ae65e71dfeb08fa75b4baa8ef
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\304574df\pnnfemgpilpdaojpnkjdgfgbnnjojfik\content.js
Size 6KB
SHA256 4307187a58cde5dca07316df4b950fda6381391af8b63ee8be31cbcff65ad1e0
MD5 07139eaa9d1fd2d7c3b47ef37578bbbd
SHA1 782122104e812fc11b30f38f47d142c6de7a2cec
SHA512 3cab09b0a43f9587c4f70d9bac6f8b9da3de34cf5e739ffd6336ce297500f84486487dd0bf4194e5d523bbb9e4cda209d16050ca8e53d07c5af3496fd78d88ed
SSDEEP 96:TRhyeJTjGk+IJ9KnQrM7SEYvnk56MbabmtzhAoutEoXjUy3AjBxm8PAPH/VdQ4Yl:TRoOPmIjLrNPhMbua9GEJqei4AP/0bl
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\304574df\pnnfemgpilpdaojpnkjdgfgbnnjojfik\lsdb.js
Size 8KB
SHA256 dfe75314a9d6e0a3e74b4932c58e81ce8ffeb0fd83af0663a4818698f9f056d1
MD5 0a4c526d7ab529d15a4bee9e218bca79
SHA1 62180ed7a558bb3c3347a81e030c8414d0c4807e
SHA512 2a78ffa0755f9c44c82ccfd2bf36a08c6d80afd46fae152317b0a285220ff8666cbef0e5bb15582bf0e6955432b3c276a44b15f9c1ead76f0b0969e95c9dfda0
SSDEEP 192:ju0N4gsiyaL+Eubn6ioLsS1xOB//3zEbAV0/+lkBfx5dVuWpUrz:jnKH8+EuWdsqA/D0Aa/mkLb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\304574df\pnnfemgpilpdaojpnkjdgfgbnnjojfik\manifest.json
Size 599B
SHA256 68a0add3f0e6aac3227c32aaa5cae8fbcdf6516b8cabc0d9b897c4a9c859a93c
MD5 0dd4bef985399553129709a27a82936c
SHA1 9fe1b37191e28798f3f809e35e8cb612d55bddca
SHA512 0259c7beaf6ce9780e069d48e0c78af54acddb4decf3dfd4c46e6dc9e814d00bd37c14ed2c7d9f2c1bbd963e551bd81cdc91b424032ca0769ff5a3ab430bc72d
MD5 SHA1 SHA512

Submit Download

sP1.dat

Path C:\Users\Admin\AppData\Local\Temp\304574df\sP1.dat
Size 1KB
SHA256 a9ac99e88d7efe4bf4fcf619a97dcf0f41b06cde36517d305e61375be63e893e
MD5 9823fe5bda0606972b9c98866407fb39
SHA1 591cf4a4738dd05eaf9cf55b48c34a09438dd25f
SHA512 3f3e616a550542f97e1b19b6e5550b250755d5b4f0e7d3086f270f544b49d34d50e5cdf941408d94356f8d97334b4ac90d46b2cba6b90ad65f044d5725d6c9dc
MD5 SHA1 SHA512

Submit Download

sP1.exe

Path C:\Users\Admin\AppData\Local\Temp\304574df\sP1.exe
Size 623KB
SHA256 94553457b3d86e4527651df80e3aa28a0815f9a985e4909a7d0b344fb057ea69
MD5 b2618483d2b505447782784d83fc3c6b
SHA1 5805f72466a86ab72fd328bdafbe20784a02cfbc
SHA512 b4b60df94f5a4ef16778ba76d504ead9d8f3fb5e9dd3f5e3d5f4108936572ff42e4a54cef61244761df0c9461511f33c0204adfa45ff97b89f4edc38757fc734
SSDEEP 12288:65EMydnlx57kytvWxtE3JKtGCIAYoUEEhY:65ByplxBkytvaE0cKYjEEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads