2ff69cdd77614dcff9d142f2a54b3be5d1e0b4606c0238e1edec32a7570dacfb

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.exe
Size

93KB
MD5

251326f3b4dc06cef5fdb8a2d9ee3768
SHA1

221f718cc83a3dfafc1f447de756f1a37c5a39a2
SHA256

2ff69cdd77614dcff9d142f2a54b3be5d1e0b4606c0238e1edec32a7570dacfb
SHA512

0a9b173c83a94da09f735956deafc80b5732660ebdc6614ac582a8adb2ae9120aee61e8f35df959536a2efe9a607f2cd384c65321dfa9bf0aeffdd1d1f88e44d
SSDEEP

1536:C3q5BUQWTEd7XPsoNYLw8Swx0RPgEojPqkXhep8NwUrSscGU1q/9J5onEhND3w99:bBUjYd70oN8Jx05gEo2kXQp8NwUrSscT

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2636	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2636	2300	251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.exe	29
PID 2300 wrote to memory of 2636	2300	251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.exe	29
PID 2300 wrote to memory of 2636	2300	251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.exe	29
PID 2300 wrote to memory of 2636	2300	251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.bat
  2⤵
  - Deletes itself
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\251326f3b4dc06cef5fdb8a2d9ee3768_JaffaCakes118.bat

Filesize
296B

MD5
810bec0a9f992b4945337b9cbddc5480

SHA1
832a660436bd8a8b55dc7e57da411dfbfa0ff217

SHA256
219763391d0292801e06d7e1dcb4c6dfddcdc985861ad19c07a42a049f1e3ceb

SHA512
80f8dcfe8abf5d32c66228c410e78e81c70e0934ee58daecd254928c0e6a22c5e3c9241ffab68472a466a596bae1befbf454abbbe6ce1b7df10ca902864a1d8a

Download Submit
memory/2300-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download