62da9734fae92cfe7ec35bd772d6f585605a3375ba2bb0fd4d703f8d7f89766f

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe
Size

105KB
MD5

3a193e9a95d4b6335a9e84c35ebaf1c8
SHA1

57965222b7ff57fbc727f93bfd3f25ca77115abf
SHA256

62da9734fae92cfe7ec35bd772d6f585605a3375ba2bb0fd4d703f8d7f89766f
SHA512

a9f98bd91ac30aedd9687687b625a4223c45457a2e3f5d29fe309efa5bbb847bfeaf38011e3895d82b791611da86ebfc6cf5d3a2afda529d5d0967419f8ff0cf
SSDEEP

1536:DuLdaekIpG1GCDPy+EiaD4y3oAYp+d5qw6Re+u5s7caIsKAMGYxV3hcRvgJfpasu:bep8PHGDUw6ReOcabMGWV34vgPaN1Hf

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1348	UNICCodec.exe

Loads dropped DLL 9 IoCs

pid	Process
348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe
348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe
1348	UNICCodec.exe
1348	UNICCodec.exe
1348	UNICCodec.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	1348	WerFault.exe	31

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1348	348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe	31
PID 348 wrote to memory of 1348	348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe	31
PID 348 wrote to memory of 1348	348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe	31
PID 348 wrote to memory of 1348	348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe	31
PID 348 wrote to memory of 1348	348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe	31
PID 348 wrote to memory of 1348	348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe	31
PID 348 wrote to memory of 1348	348	3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe	31
PID 1348 wrote to memory of 2720	1348	UNICCodec.exe	32
PID 1348 wrote to memory of 2720	1348	UNICCodec.exe	32
PID 1348 wrote to memory of 2720	1348	UNICCodec.exe	32
PID 1348 wrote to memory of 2720	1348	UNICCodec.exe	32
PID 1348 wrote to memory of 2720	1348	UNICCodec.exe	32
PID 1348 wrote to memory of 2720	1348	UNICCodec.exe	32
PID 1348 wrote to memory of 2720	1348	UNICCodec.exe	32

C:\Users\Admin\AppData\Local\Temp\3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a193e9a95d4b6335a9e84c35ebaf1c8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:348
- C:\Users\Admin\AppData\Local\Temp\UNICCodec.exe
  C:\Users\Admin\AppData\Local\Temp\UNICCodec.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 472
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\UNICCodec.exe

Filesize
33KB

MD5
9f3a6d861d3ef30dd30c11a0de5a6800

SHA1
728ec7ac84359b8c89f8dacfb42b1747283e7100

SHA256
ca86165448cee2af3890173190c923ab31735a14a56cbd3c226b693cfa379a54

SHA512
837bad57fb539b02f1da9c17a57ed019ee3c41b6defb2fef5aa8636864569f6f82a126282b0f8788277a7f7cbfc571ba8f1d4ac1f7e9950ff1b24c3ac06f9496

Download Submit
memory/348-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1348-15-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1348-14-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/1348-21-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download