18d8fd7e34c21b0e2bea3726a42304063088afac8c2a3280d26872226fda3e76

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe
Size

209KB
MD5

411224fc80b5ef84eb9154f5851b305d
SHA1

d0b6b1aebe61a33f3835e1d27de4cdcf23a4615b
SHA256

18d8fd7e34c21b0e2bea3726a42304063088afac8c2a3280d26872226fda3e76
SHA512

8116c8ab5beb7c5102a56a788cd246e42fa37bdf383a871dcff91e4b8f061de5538f5bb395dd1fcf393a2e1d778d2328e2f145976fcc1eeb426bcffbf4d97838
SSDEEP

6144:IEemuGYIMrvYVcMN1ffQF9QidTyL32sdXTysE:IEeBPrwpXidTYZT/E

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1956-2-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2496-5-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1956-13-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/688-84-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/688-83-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/688-85-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/1956-196-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2496	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	31
PID 1956 wrote to memory of 2496	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	31
PID 1956 wrote to memory of 2496	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	31
PID 1956 wrote to memory of 2496	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	31
PID 1956 wrote to memory of 688	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	33
PID 1956 wrote to memory of 688	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	33
PID 1956 wrote to memory of 688	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	33
PID 1956 wrote to memory of 688	1956	411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2496
- C:\Users\Admin\AppData\Local\Temp\411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\411224fc80b5ef84eb9154f5851b305d_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\742F.7E9

Filesize
600B

MD5
de1ddf3d3238f2e3707680f9734173ae

SHA1
a872c151fec9519724423184d78926c407cb27e0

SHA256
76ec68c2ae37b5d7b8c8dafd5fa962542580b54599cb45963eeb2a03d119e767

SHA512
20bad2dbb43ef75515668391c500c8bf012b567aded8eeee3937060c1876fd837a725032d203db8a94ff79323f8b6a817a90575829a7ffd7d7d31cc9851ea460

Download Submit
C:\Users\Admin\AppData\Roaming\742F.7E9

Filesize
1KB

MD5
0ff20ea5079cc0d7a50985de3c7fdf71

SHA1
518df21a572ddddfe91c38dfed56c4c1209f100e

SHA256
dcd6f30a9b6758fe97e9fc3d50c8a2a9f7535205b3c9c46e82e89a3d2cdab945

SHA512
ac2e25bde0718bbb1443db0890b193af0d2a1c4674c882c8da98f8927691faa164f21f97d0d6c35af758bd196b038d6b3b379adc6aa40f09bef9fd4a0835fa41

Download Submit
C:\Users\Admin\AppData\Roaming\742F.7E9

Filesize
996B

MD5
f045c31c7a2ffe467a66854eebe845d5

SHA1
15a4488d747591c910b5e71918cc693b4594df6c

SHA256
f574e73fa5998e6bcdafb4e6892193f35c2a45240e0c493a77152175eb48f14b

SHA512
543a53610734fedc85445c16cbc49dfe75fdaa9d575b37a3edf353acf08cc18d4beb72154500efc517e0e01e2fe7a245b83ceace225cfe08f688d3b56528a9ab

Download Submit
memory/688-84-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/688-83-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/688-85-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1956-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1956-13-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1956-196-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2496-5-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download