eb9c6048ab5998d3f91c70dab2e615f673daebf3b60463f420b41094d29387b3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe
Size

224KB
MD5

73dcc83923a8c8c5239eff5ae4e57627
SHA1

711dad7f0003b9e91616a29dc1e21ab2631bdc25
SHA256

eb9c6048ab5998d3f91c70dab2e615f673daebf3b60463f420b41094d29387b3
SHA512

9e91e5b75c9744e78dbefef97ccda0d45aeae07002743c5149abb7ae51e67c6259d96249e9fbf6ff8f8047a52a59e9f8d1602972d7162766849b2193926ca841
SSDEEP

3072:RTaZLMlvaub4if/1TcNeyIr3v//sAfuY2wHc1PorRyFEtrLs6SWxMmxmEqVhfxx5:RTd4i3xcNdIrEejCEJ3fqDVNYm3p1F

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2388	4992	73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe	84
PID 4992 wrote to memory of 2388	4992	73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe	84
PID 4992 wrote to memory of 2388	4992	73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe	84
PID 2388 wrote to memory of 564	2388	cmd.exe	86
PID 2388 wrote to memory of 564	2388	cmd.exe	86
PID 2388 wrote to memory of 564	2388	cmd.exe	86
PID 2388 wrote to memory of 4452	2388	cmd.exe	87
PID 2388 wrote to memory of 4452	2388	cmd.exe	87
PID 2388 wrote to memory of 4452	2388	cmd.exe	87

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
564	attrib.exe
4452	attrib.exe

C:\Users\Admin\AppData\Local\Temp\73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Mozilla\9933TM~1.BAT
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -S -H "C:\Users\Admin\AppData\Local\Temp\73dcc83923a8c8c5239eff5ae4e57627_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:564
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -S -H "C:\Users\Admin\AppData\Roaming\Mozilla\9933.tmp.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\9933.tmp.bat

Filesize
462B

MD5
b678f30ad0286b7889455815f2480c7b

SHA1
2b129018debda670de83b5d8ad5a13cba0de8f70

SHA256
ba64ddb52856a04455a58a33afcc14c69b61706efc5eed84ce2ed7e80695386c

SHA512
3d9c00078f8074b19cd11a12a798626f414d52db9935812d9514ff41f888573ed1e58c2a73bb3e336ebaf1ff4decff3a87cb0dc8b7d964cdf1053c23c3c10ff3

Download Submit
memory/4992-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4992-0-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4992-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download