1f5fc3b9e208b760dde1e0927ef9f8e3bcbb50ff43ec12d5718e96aca8d4321c

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe
Size

179KB
MD5

1ab7d3a333759676ff41d063cd42051b
SHA1

614a4a47a07dd4c72f0b38f1e021236cbce6a96e
SHA256

1f5fc3b9e208b760dde1e0927ef9f8e3bcbb50ff43ec12d5718e96aca8d4321c
SHA512

a9d6058457e8c5f2d34b3ca4cc9cdec44efcbf08174074be3d2d2f8d8b5a6a666abb11e6b0a9f352fd1cba013bfc324b865d3125e17fa88a53b3a49766287d5d
SSDEEP

3072:TlNAKPfBJ5EITVe9Yomi0/jsOKG1atpykCy7Kid1ZmMcry/0m4DMWAmqqIZwHY85:xNAKljVe9YxCVeqKyVd1UvTomK+HYYH

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-2-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/1620-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1620-4-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/2528-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1620-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1620-124-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral2/memory/976-128-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/1620-292-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2528	1620	1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe	94
PID 1620 wrote to memory of 2528	1620	1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe	94
PID 1620 wrote to memory of 2528	1620	1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe	94
PID 1620 wrote to memory of 976	1620	1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe	97
PID 1620 wrote to memory of 976	1620	1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe	97
PID 1620 wrote to memory of 976	1620	1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe startC:\Program Files (x86)\LP\3FAA\C41.exe%C:\Program Files (x86)\LP\3FAA
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1ab7d3a333759676ff41d063cd42051b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\A9917\5B03F.exe%C:\Users\Admin\AppData\Roaming\A9917
  2⤵
  PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A9917\7506.991

Filesize
996B

MD5
97dad8aed9eae3960a973c06500001bc

SHA1
1cf4b5bb4931ea5d1ab0b3992181ed2bfa4adb14

SHA256
4937a0fcb2b333662eecd69e87d70a21cd4103984ae697e1a72353010e737596

SHA512
39504932dbe0d97e65c827f7342e03a23f11dcd48f919192f35059a05528f9234beaace00323d0f05348ab350317cf3e0b1832bb7b339fbe1cf580315e8f6312

Download Submit
C:\Users\Admin\AppData\Roaming\A9917\7506.991

Filesize
600B

MD5
773a910806d2425c0eaa5a19266d96d4

SHA1
ff54080550eccfd0b209b029872fccbc60007dd7

SHA256
2aa545d6688522fac7f916e90f7703c1415f0f6de788ec5c29de6772279302d1

SHA512
bf79fd5f27af0d0bbae07feb1e081d93f0c169b7f5fc9d9d1fa37ea094d42bd60b136d3d00dbb65713273576b29e3115e0e0d826bc314e1553db0df7ddaa7116

Download Submit
C:\Users\Admin\AppData\Roaming\A9917\7506.991

Filesize
1KB

MD5
35a6f4c5338cd138c19b67030c660654

SHA1
679195bbbe97cefcbd831b5e5a0aa20e58eaeef1

SHA256
70d1b028496abdce5f84663e72f52c0f85882392b917268bf12b9f0c56c639ac

SHA512
33291776faede38468c0e4438fbd699630a3036e3377a2ff491cb9a3d48a6725cdb87c1c5112a5def6ffc5e8cdd460cdb49c058c300de326460af24d7dafd9a2

Download Submit
memory/976-128-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1620-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1620-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1620-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1620-4-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1620-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1620-124-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1620-292-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2528-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download