67e09012b104a8df2a0a3ca3ce7ccf04007400727e892bb200d3734d0e602bc9

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe
Size

1.3MB
MD5

fe0cbcda43f85e76aa034e0ce50138a8
SHA1

23b0d8bad9fa2d51c58922b2c90e8c63ad2a6186
SHA256

67e09012b104a8df2a0a3ca3ce7ccf04007400727e892bb200d3734d0e602bc9
SHA512

abbef58f1aae2421c1b3a0ee6ef7b730307358b332bb38f9eff932bef51b23ab16ff71f4f214a43f642cacaecad48d5d44624c752fb9a4cd5c971ff5887b67da
SSDEEP

24576:FN0GwyBuP3nClQbhuaVab2FzUqh6v5BunN4EcS0nz+FbLdY:vFwyBuPSlqhuaVab2Fzd6fI4SFbLdY

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2976	2380	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe
2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe
2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe
2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2976	2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2976	2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2976	2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2976	2380	fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe0cbcda43f85e76aa034e0ce50138a8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1016
  2⤵
  - Program crash
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bottom.jpg

Filesize
244KB

MD5
0591afc40d8bd41b181d5146c0e6a09c

SHA1
c4026d1ac3ac27ebc346449293143aed31e5b4b5

SHA256
32a630f1098561b3ddb2eca520f271ed1d05b2601e9b222c781d454848d96ad3

SHA512
88e8237d7b216e7ee41a0f185f7e753ddec77b30b08f3341100d0f7c54dc1d3040018162faee9c091490da0fb463131538b738cce8937f00cdad3137f8f21e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\header.jpg

Filesize
3KB

MD5
1fffd38bcbcddd52c8f171812c897e14

SHA1
753f8226acab4970537358973d3aa9cff789617a

SHA256
e065105abe1d41c492e6097958e497cbf120589122d15c04a0791c30f63a770f

SHA512
b092d5e2ca6623a2875b8e9005a27c189cc2ac6cdf7815f4da179d253ac0419a7ae16e96f9357b09655b843d9d71842a94d9faa62415d74df3b2bc0b643e7a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\side.jpg

Filesize
120KB

MD5
422d231d075e34c071a12bef00e8ff59

SHA1
fc64c81795cbf1ff125146b1cff0fe02bdf55a7a

SHA256
da21e4b1de8ae12a4f49b72954f8c6416ed09075ab777143baba68fc75f9e366

SHA512
8e08da11248d64b82b69e90162b4e68c40ea2f9678f3a21e7d6652f5e380ae78761a430248d560c6fc66a5983c2eca06fe192dc6aac0ff2698801062ce3ce3dc

Download Submit