1e942e5b91b23fce1f433ef62eab33ae5960e63303839d2e050a4acb2cbebd89

General

Target

684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe
Size

591KB
MD5

684f35599d9fc1dc0f49c97dbd253027
SHA1

abf9dbf41a6b0b5770f938b2e0151c2efc755cea
SHA256

1e942e5b91b23fce1f433ef62eab33ae5960e63303839d2e050a4acb2cbebd89
SHA512

2c81491f166d5c5aedde5bd2d835cbbd372edf7227335e257aa7c4f55b4b394a76f3b49e3cdaf21a02e0c1c1a59ab78600d531c6647a2a70c9d0b13f9563624f
SSDEEP

12288:P862Oi5XQhEeZHauP0MbadCGA7yeREK14sCbWFL2oQ2PXVo8+:P862Oi5XQhEeZHNbadWye74sCbjm+

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2932 set thread context of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2764	2932	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2620	2764	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2620	2764	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2620	2764	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2620	2764	684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\684f35599d9fc1dc0f49c97dbd253027_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\938.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\43489.exe

Filesize
591KB

MD5
684f35599d9fc1dc0f49c97dbd253027

SHA1
abf9dbf41a6b0b5770f938b2e0151c2efc755cea

SHA256
1e942e5b91b23fce1f433ef62eab33ae5960e63303839d2e050a4acb2cbebd89

SHA512
2c81491f166d5c5aedde5bd2d835cbbd372edf7227335e257aa7c4f55b4b394a76f3b49e3cdaf21a02e0c1c1a59ab78600d531c6647a2a70c9d0b13f9563624f

Download Submit
C:\Users\Admin\AppData\Local\Temp\938.bat

Filesize
175B

MD5
af8cb12a71aebbc532ca68eec428a602

SHA1
1bbc0f81ef57266c588c291a3f5ffcc3e1a9e902

SHA256
9f55494f9746b9c80914a0e4c567215d7a6419372bd0e3cfa9f60dc73b7df9ef

SHA512
eabd217e3cd1bb869726d495247187792b71581474a8039338710e6d0b663ac875582743fd90da9956e70c035f3a54e6edb5c281920632b297846634ca0099bf

Download Submit
memory/2764-8-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-16-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-14-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-10-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-6-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-4-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-2-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-0-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-17-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-15-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-12-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-28-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2764-31-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing