69558fe1c00c986dad7c2b3bc55da3cb01fb0930f7469f28243a2f49d5cb47b4

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe
Size

387KB
MD5

443f0d736b6b5f201c936739d7f6a3de
SHA1

add61db8382d52de51342aaf0e36dfa399509d5a
SHA256

69558fe1c00c986dad7c2b3bc55da3cb01fb0930f7469f28243a2f49d5cb47b4
SHA512

41b51cc2ef5a5328d87037f2ad4d996752d763113440bf1742506aa507020fa9d2f2afa63b1c6de13de68a9c31c7d0b23e9d5d26abba7c05b77f7a861b0eff71
SSDEEP

12288:hhdQMmjhli4NEgqYax0xnM5P6UilBlDF:hPQMm7i/l+pU

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2668	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.TMP0

Loads dropped DLL 3 IoCs

pid	Process
2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe
2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe
2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Menu Iniciar\Iniciar\msnmsg.scr	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.TMP0

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91162401-6E6B-478A-A7FF-994EBA35B9C3}	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31
PID 2152 wrote to memory of 2668	2152	443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.TMP0
  "C:\Users\Admin\AppData\Local\Temp\443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\443f0d736b6b5f201c936739d7f6a3de_JaffaCakes118.TMP0

Filesize
570KB

MD5
2b3069aed55ab214adcd9c3262412697

SHA1
7a094b16c3a8fc6054058dfdb241ea868f03d535

SHA256
065fda1f62f00aacd3aa72cfcadf415aa5639d5c892b10a340aab16bc853b962

SHA512
8590504b9aa7b4cb9a716e225b2bcc1fd2dc2f2428ff284d8b9fcbbe477a7d8bf3b69cd2526b19b421995b1081f84f1ac9dafdae9d905e9a79ab654b27172dbf

Download Submit
\Users\Admin\AppData\Local\Temp\ArmEA5F.tmp

Filesize
64KB

MD5
cdf9f21934221a77a7d3903378101f9b

SHA1
9f4d5dc0c2332a3c253666a64370aeba3b678287

SHA256
3648ce2ea7bdfce9c03df670088cbed0a5411513ad5a9d0d8e997483ad52c845

SHA512
904bdb088c03ac5d869148d7461775731f25724f14331a1ca6d78969293f6f20052a31a19bb263245931374bee4e3c3a873043310d3096c815feac2225b41ee7

Download Submit
memory/2668-11-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2668-14-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2668-15-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2668-16-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download