94cb5e84212a6353fd3386f2d83f5b864c64f4bd3207eff718a843d172011a1f

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
Size

1.6MB
MD5

0624c43699e11e05e7f784bebcf17768
SHA1

9058c4eaad185dd7b22a67198f51baa6b4f13cb0
SHA256

94cb5e84212a6353fd3386f2d83f5b864c64f4bd3207eff718a843d172011a1f
SHA512

4a40fa2bba990473d32abadcf88ed62f15790668d9b556e3a13994fd60a0194c762ea68c276a35f6923d72cd23e587fb0caddf62611b950edf09db2a1a57dce1
SSDEEP

49152:WQagM/VkLHwbwexxcTcoOfhc8AxOVnbw+ij/TtCUjnbIM:ZEVkLAxPo0c8hB9ijnjbJ

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1812	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
1812	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
1812	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
1812	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
4844	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
4844	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
4844	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
4844	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4844	1812	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	82
PID 1812 wrote to memory of 4844	1812	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	82
PID 1812 wrote to memory of 4844	1812	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_e9151d90"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pkg_e9151d90\autorun.txt

Filesize
74B

MD5
d8d2e91332c7d80f74c2c88eab43d854

SHA1
c75964341fbf593637d3aef581810840d5286935

SHA256
573f9a8e2bde40245c58f722286ca0d60901ff8abf3471b981d6f513e987dad2

SHA512
e1a51f805cfab92790cd51057f553afa9aecbb329d5dba054e1b5d6b4e022ae7403e2e0ce0a82a7c8f4902417fa34020844a39a120696d1c2b6ce7a354fdb21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_e9151d90\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit