a6f761c1d56a5ec649a5046345883f6338ca545cd8ef65f84682d5ac66fc7d7e

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe
Size

220KB
MD5

af1e3b35af7da25d9fd8ce234bf0ccab
SHA1

7110ca924a9d19a4a22ae6aa51affa5dce28132c
SHA256

a6f761c1d56a5ec649a5046345883f6338ca545cd8ef65f84682d5ac66fc7d7e
SHA512

0f3d7ae017344ec8c072b57dacd76c3288a8ab64fb77192f77f45e9494c9a4914584e25dd251a7c6c6aa5ce5c0370c2d06735ae0db9f1f46fca8131d6c68eead
SSDEEP

6144:9bAOO7/nl6AKOuW2HmGuWMWcp1ah4tpr8iGr:9bne4AKOuW2HmGuWMWusgprxU

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4476	1116	af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe	84
PID 1116 wrote to memory of 4476	1116	af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe	84
PID 1116 wrote to memory of 4476	1116	af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe	84
PID 4476 wrote to memory of 2744	4476	cmd.exe	86
PID 4476 wrote to memory of 2744	4476	cmd.exe	86
PID 4476 wrote to memory of 2744	4476	cmd.exe	86
PID 4476 wrote to memory of 4524	4476	cmd.exe	87
PID 4476 wrote to memory of 4524	4476	cmd.exe	87
PID 4476 wrote to memory of 4524	4476	cmd.exe	87

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2744	attrib.exe
4524	attrib.exe

C:\Users\Admin\AppData\Local\Temp\af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\WORDDO~2\1033\BCD8TM~1.BAT
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -S -H "C:\Users\Admin\AppData\Local\Temp\af1e3b35af7da25d9fd8ce234bf0ccab_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2744
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -S -H "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\1033\BCD8.tmp.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MICROS~1\TEMPLA~1\LIVECO~1\16\User\WORDDO~2\1033\BCD8.tmp.bat

Filesize
596B

MD5
fdd14eb25f8bbd040d293fb354f70d3f

SHA1
a1fa21ac09e1ffdcd9f05a470f4814e982c7d051

SHA256
e77db9d6d25b95aa7d4a86278d1041f5e1960416ef3abb2d005fe88b80c5ea74

SHA512
f04eb2c57e5391324d79126010fb618d773fbd64caa76a31738fb5c421e01858a1008825cc331c10836d53b59049e08ab100e87de211748aa653360d0bea3baf

Download Submit
memory/1116-0-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1116-1-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1116-3-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download