1bdda8b6b0748ed3973e9a5108f651bd9bcbcc096520dcb87b5f3e1a1b26f433

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
Size 1.6MB
Sample250120-mjdqaavkfs
SHA256 1bdda8b6b0748ed3973e9a5108f651bd9bcbcc096520dcb87b5f3e1a1b26f433
MD5 e46239f21dce3ec97173769759ce4757
SHA1 a24988ca0acfa022c4560cd0b40094e31d0d5724
SHA512 df792733b594103438ac1dd055d868b5f685c0907654a817c820cc1db36a9ffad643cf8781cd0dcc994bf8503c18522d4a1c42d5dccad611a963e65876e63425
SSDEEP 49152:oqfouESz1iwMTcimKjAp3lgPRgXFT6JrH:oluviwuci5RgXA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1080	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
1080	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
1080	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
1080	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
4936	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
4936	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
4936	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
4936	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4936	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
4936	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4936	1080	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe	83
PID 1080 wrote to memory of 4936	1080	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe	83
PID 1080 wrote to memory of 4936	1080	JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e46239f21dce3ec97173769759ce4757.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_a1d202310"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_a1d202310\autorun.txt
Size 91B
SHA256 166f7a0728cbd74cb5995beda0d752462031d57175067af4b37e1fb46a47cb8b
MD5 e5e6b121992b64269e04ad26acbc70e9
SHA1 1b2d0a6b9a1507cf1e79cce97b24a3838e7199e8
SHA512 3006395b9798a02735709a62e382a01e9cc3f044749a83b30dc7eefaf9353d3107cd588c36e5365a548c3260226a145f11710511cda1f463e3a20bd9cab78171
MD5 SHA1 SHA512

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_a1d202310\wrapper.xml
Size 942B
SHA256 ef43feb50e5bb1775195ca8c44f2af90661a6c06703c0a70c8e191bf9931c1a8
MD5 5c292748257ad5905629464778294451
SHA1 60881f97bf759d87c42fe388d35aca0f8d2164f4
SHA512 b1769d551421f119f92b62e5717565bb72e41f0288a0cc6f81621fd3a540dfc5370c7944c106499a0b474f50eeb6be8dbee5d3dc2618a8802ac90b73fde7aaca
MD5 SHA1 SHA512

Submit Download