f03500abcd68771c376bd47e8939b9fa53b0fe1195786fcfad36c6d5fad57ec6

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe
Size

177KB
MD5

08c8692cdc6b983b2e173c80567585e2
SHA1

8c81ec4a3895440f79ddb1e076f22c8361944944
SHA256

f03500abcd68771c376bd47e8939b9fa53b0fe1195786fcfad36c6d5fad57ec6
SHA512

497a158df265d6d9c9e0adaafe57b3b108bab9d016c5284476c593f4f5461d375624fd412e317f202a7473fb7a818d1ac7185bf0cf3ae492805b5326856ebe03
SSDEEP

3072:c215dgfPPJjaQ7JZVBGldlIzc6SBCuW7JiZuuP1AfSc5C2kHX:wnBys/i1AiZuuP1AKcQ2kHX

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2000-2-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/2000-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3940-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3940-14-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/2000-16-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3916-118-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2000-219-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/2000-270-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3940	2000	08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe	90
PID 2000 wrote to memory of 3940	2000	08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe	90
PID 2000 wrote to memory of 3940	2000	08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe	90
PID 2000 wrote to memory of 3916	2000	08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe	94
PID 2000 wrote to memory of 3916	2000	08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe	94
PID 2000 wrote to memory of 3916	2000	08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe startC:\Program Files (x86)\LP\AA35\903.exe%C:\Program Files (x86)\LP\AA35
  2⤵
  PID:3940
- C:\Users\Admin\AppData\Local\Temp\08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\08c8692cdc6b983b2e173c80567585e2_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\56208\454AA.exe%C:\Users\Admin\AppData\Roaming\56208
  2⤵
  PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\56208\8B98.620

Filesize
996B

MD5
2061ca05c7d668879ff9362611c043a4

SHA1
5ff9303f8bc1e9d481d180087f532843f9f52255

SHA256
0625a374848a3af73efa34253aa9503de07f67ac9dbba00f4f1823b81bd53326

SHA512
14292bc994ea1397b0fd9fce43fb912d83df79bb9856b5cf14ff070490e01b1ce73d2d6fffc5ac8024b14bfab06e1cd926d39aa32e15bc57b253c7e6e0c0fa6f

Download Submit
C:\Users\Admin\AppData\Roaming\56208\8B98.620

Filesize
600B

MD5
1d4e375e929007d065d0d52ef119f279

SHA1
64a78a4987566131f9a7b82d47160a568f09be89

SHA256
0427469e47ea519e721ea0c21bc4391b1d39a243f39870e2a75f699cda25212a

SHA512
2b2bf23c7db9ec4a5594a8acf4fa9b06d63275cfa35a7046b8155320012ca3361a61f75363dc6b5730a50cab731b13e39d029960a95bf178d80c5d1af7127bc4

Download Submit
C:\Users\Admin\AppData\Roaming\56208\8B98.620

Filesize
1KB

MD5
94833b736bc4f3f7786f05bf69cfd1e6

SHA1
d0470415547a50780c59430699b90257ae123220

SHA256
e3f07c1fad29f7c7fad82bbedf6aa64aacd9bcd545d658fa0ff3f15c9041fa88

SHA512
4b69560cd10df510ba08a4e0755dcdf74f84c0fc4408fb25c5cd836e62c4ac1e984b4b186a771aa0ff779c9cd37e2bf543b73f6a084691eed0841c279c8eb578

Download Submit
memory/2000-16-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2000-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2000-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2000-219-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-270-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3916-118-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3940-15-0x000000000078C000-0x000000000079E000-memory.dmp

Filesize
72KB

Download
memory/3940-14-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3940-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download