2ed3c7d7b88d98aa16bae5176c64a8fabacb82f3eff78cb9a25239e954a99ebc

Analysis

max time kernel
142s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe
Size

184KB
MD5

088db643d061a9f05d92b4c164894a87
SHA1

992466740115ff4ff5442551aa3002bfee6722be
SHA256

2ed3c7d7b88d98aa16bae5176c64a8fabacb82f3eff78cb9a25239e954a99ebc
SHA512

8d21612926f22190f85b199dfa439b3ae2fd0c94a9fa8a9de2d1d1ce03785b428cdd0a6e815bed80a3d930324e51ea20b4e03e1d04a46d1afdf24e775fdaab6d
SSDEEP

3072:KVB3UORxq7RKl8IhuSlsQipl6+JLWBJUPIRZaGvn1UGbj6N/GDoOAzt90KwD2jcm:KnEO0gHhuSls/39JIa1En1j/6NQ4P8Tm

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4644-1-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/4644-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2788-13-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/2788-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4644-104-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3696-105-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3696-107-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4644-108-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/4644-183-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2788	4644	088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe	93
PID 4644 wrote to memory of 2788	4644	088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe	93
PID 4644 wrote to memory of 2788	4644	088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe	93
PID 4644 wrote to memory of 3696	4644	088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe	101
PID 4644 wrote to memory of 3696	4644	088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe	101
PID 4644 wrote to memory of 3696	4644	088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe	101

C:\Users\Admin\AppData\Local\Temp\088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe startC:\Program Files (x86)\LP\7F44\E23.exe%C:\Program Files (x86)\LP\7F44
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\088db643d061a9f05d92b4c164894a87_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\444F1\0143D.exe%C:\Users\Admin\AppData\Roaming\444F1
  2⤵
  PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4412,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\444F1\1241.44F

Filesize
996B

MD5
77e454ff5f77bdcc2435841c01f5dfa7

SHA1
62bd9e861b1ac6209eed68bb6a070bcd5bbc86e6

SHA256
3cc0f480949f8a0905870cb5c8a91b9aca3e1530aa987769f43b7c8ba7ea92bb

SHA512
b6c6743abce908e9562076828237413c62341ed74427eccd6d4294e65eebc5dc0d3dacaa4afb26318adb4d6378c4aacb7d95e55179f4a37e3de8628a8bf94df0

Download Submit
C:\Users\Admin\AppData\Roaming\444F1\1241.44F

Filesize
600B

MD5
ca961ba323d257e444dd2b7bab44db44

SHA1
76e37d5d37bd1cd0fc5ac541d3fff17546adc2e3

SHA256
60e61b6b97c027b24d8ab9487ebaa40629505ca10a13570c1422e85b9330f84d

SHA512
b3a7135ea63535f717981d65f3bb00a7a2c2fa364a346021f6cee380cf0f8fb01dede694ecb06452fb242b3f623ab47910ef8306124e2bdf0eca5edf0a4f064c

Download Submit
memory/2788-13-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2788-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3696-105-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3696-107-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4644-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4644-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4644-104-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4644-108-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4644-183-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download