2f335da94861a7bde94044aa3fcf1cb5d5eed6cdcfb9775f89d099ceb43d31bf

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 21:20

Target

1c899233bb580ea68717d0d4743d59ae_JaffaCakes118.dll
Size

59KB
MD5

1c899233bb580ea68717d0d4743d59ae
SHA1

bc8e81af687f91d9972447e7aabbb19012452083
SHA256

2f335da94861a7bde94044aa3fcf1cb5d5eed6cdcfb9775f89d099ceb43d31bf
SHA512

a4b70950b348bf51f918338f395556b93fb1377efe4961622f5e774056cb9c1b4db185cdd1021243c5ba989f7d7cc569839fa0cb6753945562449f7863d8ba19
SSDEEP

1536:P5RnVR8Ax0MtYSUXODL2ih4T8zj6719ja43g:PXnb+MeqLh4eE993g

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2944	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2944	1712	rundll32.exe	28
PID 1712 wrote to memory of 2944	1712	rundll32.exe	28
PID 1712 wrote to memory of 2944	1712	rundll32.exe	28
PID 1712 wrote to memory of 2944	1712	rundll32.exe	28
PID 1712 wrote to memory of 2944	1712	rundll32.exe	28
PID 1712 wrote to memory of 2944	1712	rundll32.exe	28
PID 1712 wrote to memory of 2944	1712	rundll32.exe	28
PID 2944 wrote to memory of 1244	2944	rundll32.exe	21

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1244-1-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2944-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download