66fe0483c998b8fefe4c7a00f474ff5f8714aff6204c58d247ae7d6cc708edf6

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45210bea4ff06557ebc0b8183e62b3c6_JaffaCakes118.exe
Size

330KB
MD5

45210bea4ff06557ebc0b8183e62b3c6
SHA1

7ad878576b86b4f40b3acf2f75b2adae46e90a4d
SHA256

66fe0483c998b8fefe4c7a00f474ff5f8714aff6204c58d247ae7d6cc708edf6
SHA512

37baf376a98b4265b535287e8c3041c57c9ea0af63b1daaecd172eea165ffef0b96ed9f15c839440e76af4a7d503d23b7e7d32992b647b37414b24037f161b35
SSDEEP

6144:F0K3AcDDyHNxf2fjNpBwx8v3fKBWZezxR68v1P36LIRvBrzQirhSXNyQ:F0K1m+fjjpv3fKKetR68oIRdzjaNf

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 3044	4540	45210bea4ff06557ebc0b8183e62b3c6_JaffaCakes118.exe	86
PID 4540 wrote to memory of 3044	4540	45210bea4ff06557ebc0b8183e62b3c6_JaffaCakes118.exe	86
PID 4540 wrote to memory of 3044	4540	45210bea4ff06557ebc0b8183e62b3c6_JaffaCakes118.exe	86
PID 3044 wrote to memory of 3520	3044	cmd.exe	88
PID 3044 wrote to memory of 3520	3044	cmd.exe	88
PID 3044 wrote to memory of 3520	3044	cmd.exe	88
PID 3044 wrote to memory of 1760	3044	cmd.exe	89
PID 3044 wrote to memory of 1760	3044	cmd.exe	89
PID 3044 wrote to memory of 1760	3044	cmd.exe	89

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3520	attrib.exe
1760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\45210bea4ff06557ebc0b8183e62b3c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45210bea4ff06557ebc0b8183e62b3c6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\MICROS~1\Office\89E1TM~1.BAT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -S -H "C:\Users\Admin\AppData\Local\Temp\45210bea4ff06557ebc0b8183e62b3c6_JaffaCakes118.exe"
    3⤵
    - Views/modifies file attributes
    PID:3520
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -S -H "C:\Users\Admin\AppData\Roaming\Microsoft\Office\89E1.tmp.bat"
    3⤵
    - Views/modifies file attributes
    PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MICROS~1\Office\89E1.tmp.bat

Filesize
480B

MD5
f70580306e659b5777a3c85621b0743c

SHA1
efa2e5c36d7ad1c8f0113ad33f8ed54b27bbd50c

SHA256
9f45ea5a5d0959b3cf0a4c4182f7a0ff7e783a63da70d2b07b07fedce677dda6

SHA512
057ba806f3ea1722892b7817c79a4c82dea8a744ff90186602efd76d52b6c06b86efe0196c63940c54ea747e8063d8f663b81bb2a9b3cc4f3f9d79204448ea98

Download Submit
memory/4540-1-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/4540-2-0x00000000022B0000-0x00000000022FE000-memory.dmp

Filesize
312KB

Download