f9dca655f46f0f1a65a3b6709b0370f092674f75caa48b49ff34d1bee2becec5

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 18:32

Target

4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
Size

1.5MB
MD5

4ae496f2349d738bb2fd38b3d46f70f6
SHA1

c002fbd26b15940427a2d9fb114d9c9e9e9d02ef
SHA256

f9dca655f46f0f1a65a3b6709b0370f092674f75caa48b49ff34d1bee2becec5
SHA512

17805aef97b960083242226b7a6137a2b873e3c410d54ccdf5a7d4150998df630dbd20501a978331da391db51fbf841d8cfba37bcc39662cb3f80cb018bd7439
SSDEEP

24576:jRSFRFf9jwdcpom2wjIOtRh15OO7r2AEa/VrijG8xDsukE25TSNTzqujnOAJIF6:unf9k1mh1tL15z7r2AEa/VrAFTkEHTGC

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4812	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
4812	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
4812	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
4812	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
2800	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
2800	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
2800	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
2800	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2800	4812	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe	84
PID 4812 wrote to memory of 2800	4812	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe	84
PID 4812 wrote to memory of 2800	4812	4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4ae496f2349d738bb2fd38b3d46f70f6_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_12292a2070"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\pkg_12292a2070\autorun.txt

Filesize
87B

MD5
6411ff9ee89a6d79f9e895c0b08b5e86

SHA1
fa921e62a0f672fdba050b5d4718cf50ecaf6488

SHA256
2e0769d87b7163f3eda5119d8b9f9f13aefa24aeb9a5ec6408679f40e3a189db

SHA512
2a492cac566c49f49b627c49e88d5479aa01b5646de83342d154453edebc55de91198cb0af61ccc74cd1249fb990ca0338159fbd715148e89fda2e2293dd6d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_12292a2070\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit