5a71caf6bab3fd2cf0b328e10568caba4a3aebc5a3cdca10bfd3c12216f7c48f

General

Target

11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe
Size

576KB
MD5

11d95f174aa9f742d0ada8e9253eba01
SHA1

9492571072d1e625e78d42d09fb0b317e902f739
SHA256

5a71caf6bab3fd2cf0b328e10568caba4a3aebc5a3cdca10bfd3c12216f7c48f
SHA512

e87fbf6fa0e70c4b1ef1dfc321ce0d22c6b72ecea45d799b54617076ccbcdb5b6e6944df06967671f6b6d3d21d2b254513146bec82c30a0ab35e5554725089ba
SSDEEP

12288:dDlZNcJaOcOmbFrtWD6kFX9wwf0EhpBeIOlvXd6ptW:dDlZUaOcZbFrtpkFX50EhpBTUvXyW

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe
1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4280	1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe	96
PID 1616 wrote to memory of 4280	1616	11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11d95f174aa9f742d0ada8e9253eba01_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ultimate-downloads.com/ThankYou/downloadmanager?source=engageBDR_downloadmanager-US-direct&userid=81789d8b-6483-4f6e-be43-d234e5ab8ca1&et=0
  2⤵
  PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4104,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4404,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
1⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4684,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
1⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5600,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
1⤵
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5736,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6016,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
1⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6232,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
1⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6440,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=4136,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
1⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=5364,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
1⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6336,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=4172,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:1
1⤵
PID:4676