e361d8c4969e59f50d44309c5ba532f169417488d0500d1e738fac47374daa0b

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
Size

1.5MB
MD5

8802ef204e3dbf608605ddf123f38313
SHA1

0326a63c3cc319cda4db601884df5af50cc1faf7
SHA256

e361d8c4969e59f50d44309c5ba532f169417488d0500d1e738fac47374daa0b
SHA512

4555de9b44090e6990fb0c7ef6649f48448b4e5df07807dfbc2393ae01f902e18557d9c8b8744401d72e229ef2944b9eb0f6f6c1772b141c5797b059b600b9d8
SSDEEP

24576:LGoseufagFnX8dfncq6cPwKPqnLolyMEIChp2GClQjX0bX7xNTlRFbJjnOAJI8y:uZfaeqn56wwQqLolrEIC3J4r7/Tb3jny

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4120	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
4120	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
4120	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
4120	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
4832	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
4832	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
4832	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
4832	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4832	4120	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	84
PID 4120 wrote to memory of 4832	4120	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	84
PID 4120 wrote to memory of 4832	4120	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_163921ea0"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pkg_163921ea0\autorun.txt

Filesize
89B

MD5
58a969b357590fd2971439d5ab343379

SHA1
1f46d9495212b01e5624dc7cbeb863620bfdb0d3

SHA256
a6dc39a8d53b41ac452447af08fcd59986ee143ea1ebd61c7bb1933803e51215

SHA512
a554f247fe1920fef1687956036981d377a86481801d9ffa2da1ff9241fcae10ffaf9ed26faf9834a769a0358f624c5d0ad2616806453fa61282469ef8d11399

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_163921ea0\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit