b36c9ca12d0a7a000d0685a7a95db37556623bece2f0d426dd30ac537577a2be

Analysis

max time kernel
93s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d9553a3ef655d711947970430b497c_JaffaCakes118.exe
Size

280KB
MD5

04d9553a3ef655d711947970430b497c
SHA1

f6b5f31f1a2fe015ccf12fb8579bdda5fcc83e7e
SHA256

b36c9ca12d0a7a000d0685a7a95db37556623bece2f0d426dd30ac537577a2be
SHA512

0512c9b2128018e6d08c48457616f2ad1f01dcf0a1b12740d5ebc7c9ccbb22908ffb1bed31404b6cf87a395ff49b6920ba4f6b3d1d66a9e1a0428fa587c17e7c
SSDEEP

6144:2SQFHumylbK0z30FjRomWnIsOSgve6/KbkxQZE:W820zkRPWnIPnvPKbkxE

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\test.txt	04d9553a3ef655d711947970430b497c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04d9553a3ef655d711947970430b497c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4300	04d9553a3ef655d711947970430b497c_JaffaCakes118.exe
4300	04d9553a3ef655d711947970430b497c_JaffaCakes118.exe
4300	04d9553a3ef655d711947970430b497c_JaffaCakes118.exe
4300	04d9553a3ef655d711947970430b497c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\04d9553a3ef655d711947970430b497c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04d9553a3ef655d711947970430b497c_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk

Filesize
1KB

MD5
63de24ead9e71258a5455959320ae31b

SHA1
9da9e9e1c742512c008dd4c5feff943e11b961b4

SHA256
ea3054c74d8d099df5dc9fd05f6d22aae19f65b0571bb6e1a6cb66b7a61dc468

SHA512
bca3f942dda70784052adcd13a7d1750b5531b7914ee0a75519ede28a7379d72e33e5db74197e30027dc06bbf58f247534ca4e1be3e5f0a7e40a9cd14905f63a

Download Submit
C:\Users\abc.lnk

Filesize
1KB

MD5
5384d90206b216c3cf3f1c7fd9ff1606

SHA1
2d8160de91f742197b03583c40f87ce959932d19

SHA256
d9b4ebf1f90b9c8669ebac21afca3ae765177f7c271b83ef118a27a1e99390fe

SHA512
cf37704989a1bdda29934bff9f13a009f03339ded878182c7f2429fc8fe749e7a48dce7e35503b79456b52ff7bb39773ca75f6ebe98da463b2473ff796f78ca7

Download Submit