Overview

overview

10

Static

static

10

45ab445f99...18.exe

windows7-x64

10

45ab445f99...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-03-2024 22:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45ab445f996969fefe0e530ec2827515_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    45ab445f996969fefe0e530ec2827515

  • SHA1

    6b0b2be8348c381051c54a5d3bdecd2d44d1abf2

  • SHA256

    6d8b3a1bf9dcc6fcd92a2388fb8e2dde25de097b50c4bbeff7a9e579c23bfc61

  • SHA512

    900d183f4491ed0e7c8c275226ecf64a25b3b0d44e7a71189a7a28ae6b1ae87bd7ea7e1eb4b2e6ecde3db5210a586632835d3adcd29e4e15679d181bdf92749b

  • SSDEEP

    24576:VqBk70TrcXkF3EPDA5AtiKhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRg:ykQTA06PD7o54clgLH+tkWJ0NG

Score
10/10
echelonspywarestealer

Malware Config

Signatures

  • Detects Echelon Stealer payload 1 IoCs
  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45ab445f996969fefe0e530ec2827515_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\45ab445f996969fefe0e530ec2827515_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1652
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2A4B55DEC.tmp
      Filesize

      20KB

      MD5

      c9ff7748d8fcef4cf84a5501e996a641

      SHA1

      02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

      SHA256

      4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

      SHA512

      d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2A4B55DEC.tmp
      Filesize

      46KB

      MD5

      02d2c46697e3714e49f46b680b9a6b83

      SHA1

      84f98b56d49f01e9b6b76a4e21accf64fd319140

      SHA256

      522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

      SHA512

      60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2A4B55DEC.tmp
      Filesize

      92KB

      MD5

      4c2e2189b87f507edc2e72d7d55583a0

      SHA1

      1f06e340f76d41ea0d1e8560acd380a901b2a5bd

      SHA256

      99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca

      SHA512

      8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2A4B55DEC.tmp
      Filesize

      148KB

      MD5

      90a1d4b55edf36fa8b4cc6974ed7d4c4

      SHA1

      aba1b8d0e05421e7df5982899f626211c3c4b5c1

      SHA256

      7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

      SHA512

      ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\ls078BFBFF000306D2A4B55DEC.tmp
      Filesize

      128KB

      MD5

      a7a11fc665d73f1f784f1226be518de4

      SHA1

      e378f2b67c1379d14fb1131efac04c2f1bdcf900

      SHA256

      ab0c17cc5f59a6f75c1148cac5157b6128ee6ffb321a7857e48ed357fb13b965

      SHA512

      1a45c011d126310a94190f9e7ec6a2c5c2bd6fe501e525834646f196cf05700546ba6398d4ca20002036c0ad0111337ae9315d49cd75ecf51986d57ffbcbc48c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-03-30T22_16_36.0633852+00_002222
      Filesize

      96KB

      MD5

      d367ddfda80fdcf578726bc3b0bc3e3c

      SHA1

      23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

      SHA256

      0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

      SHA512

      40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-03-30T22_16_36.2665046+00_002222
      Filesize

      288KB

      MD5

      0412d4f1fbbc8a52195c0dd0c4526eb5

      SHA1

      8e3c27b0d10adf47213956a1b53a30488017a948

      SHA256

      e3e09a94b9254c4f8f1b0d17f07b14a4e3df56eb70f32b2ed72673c72430e190

      SHA512

      957faf91c2fcb46f7503e1046f45707a678d0b6eb15ad045f93030a0694eea79081e37e440a2e704ec1cc6cd946d6d3b7e4e897914d133fe551d7cfe42df88a6

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      256B

      MD5

      9c7de2d8d314259446c889c45bc6fae9

      SHA1

      cb5209ccdab75ebf2c82985699fd51c1afadc372

      SHA256

      e790fc324f53f1979a39d8c555e7e6d38aeb4ef3e1c4a841711055d778185871

      SHA512

      271eea224472a7202bbbf5144a63f59faf708815097376cb1adb88bb8eb611c2c94f631fa9a757153475bfd95a888a1952098c15d8c46311a1d3f66e29025c03

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      1KB

      MD5

      6ca856c7d40e1edc69008e9f4f7a7ba2

      SHA1

      62b795c02b6b02e313c15e1c369991f08814a95c

      SHA256

      a8cdd831224a169d08a48633ace3675d98a243ccff849a85ebd1e95a76d04242

      SHA512

      6423bb1e45a8277b2c3ee1cb21324a8abca3735efcf8e45d1aa27e597230e37f01999a3229eb98ff2d42e68de17bf1f093546f5d7e89f246fecdb4b04e9d1db7

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      1KB

      MD5

      e21da2b922a86aa441a087588d8ba063

      SHA1

      eae0e83300e2fd672a5b75989f9934658aafc42e

      SHA256

      80a07a4e8531475b3819d1a9611b8bdb0205702bb6c7f96729cbc4b9ee496758

      SHA512

      e3131a211c6e5ec2ccafb0378fabeed48156b5e8df2d6ecb0b7dbfa47a7ca35244114ff788e72b8e6950be9bd3ed1fdcc4863b18af8d3103449e07abdd039343

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      2KB

      MD5

      88fe72ee318201e46a1fc7f58fc5a0f7

      SHA1

      799df8bb300d508996d900212edad6170a9bd2bf

      SHA256

      d62a3f605afb8ed80e349f488425d6fb576b9acbf0c8afac0cc341bbc7096912

      SHA512

      1ae6ca9d5e0295124618832910a062ddc85d3565dda03b1886bd0dcc483c861b21de7605713ed27813c15b9ffa4e0757c46d77a15c21a81cf41099e820294a9d

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      2KB

      MD5

      656726952302f87aa14938d0db9ee454

      SHA1

      a7218b06ef1170e77be390b33877b38519f19e28

      SHA256

      51664925b2e581d6a27d81a84273aaa8a1dbb6572956a5455bc73e1868ba6e8b

      SHA512

      101e39b11d24bbca94f815458c9c2296b724a9104cea9070c143216a69514b51aecb98d97be8899d4e0c925d7749557d9cfe61e35250dd8004a8154b538fd5c7

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      2KB

      MD5

      81b99703a3960d307cd3ab62339c6d2e

      SHA1

      78a2f3bc7bb88f881a2511cc2de8221c48f81a23

      SHA256

      2ca6e84f6978690a4fbe9f8afb9c8906362e17dfec9da01861ed44ac3df4832d

      SHA512

      33182c99d24f276968c8c85686593b71efdfca475e630864f5399895d83aa1d320b0de7866c1cce2231d02b80cce641e71763d28535ed05e90b9b0ad70eb478d

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      3KB

      MD5

      e181e9fc3087583b84164406113f6321

      SHA1

      7244c18a52b2c74fa39b7104e779f304b9ae4c12

      SHA256

      6661f2827c61623c6e7ab76fc8c79eb9dc4289e564b781d1f573fbf6f1a2f880

      SHA512

      0686425870c1faec44ab2becaff21a17aaf9ff89bf7d6ad7e41cc2ff0cf3e9f9c17028c614b4982a61e5adccb9cbed99a8edb57f85d962bcaa62858eb55c8249

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      3KB

      MD5

      78dd6580ce6665dd6d6c2f0c244463f8

      SHA1

      67cac6c403c3f17e1c0722fb0c2eb250fd8241d8

      SHA256

      ce4f8a9c0b97185ba35cffcf896ffb5076a0b82a13d250b25c452104583a277f

      SHA512

      31e53c2f36069f2491f2fa435e147abfa64467f495e99f5818f000a9c73c99600fba4cab10fc1e9a7ea1b866ab519a26d8444325c0db738952d5e42a929c4b39

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      426B

      MD5

      42fa959509b3ed7c94c0cf3728b03f6d

      SHA1

      661292176640beb0b38dc9e7a462518eb592d27d

      SHA256

      870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00

      SHA512

      7def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      4KB

      MD5

      266b750ff315185a8866f8a186995b76

      SHA1

      df45b2f0e9a4647cc74b90e7a13bc613c49fa93a

      SHA256

      cc40de1552dab9ec217ede32da2c13a8afcf4ad8e440143a0028099035586dd2

      SHA512

      3a7e7e9d664c02b65998cfb489a24d403e20593ce5f84484dec2e56d76a759ba8403e1671f0a6460388c268387978916cc4dfb3a5a2e47d2b0a6ed17a7014645

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Browsers\Passwords\Passwords_Edge.txt
      Filesize

      852B

      MD5

      f6112b3498179e945ef8ca979e810858

      SHA1

      78411bf22b09f0243f0c4405970b292e8f391f41

      SHA256

      72b2b8ebdc6ebf268b47939e38ff5c6439d458b1149af61b69103de2a0f3feb0

      SHA512

      1ab7bd43b6a62c79336d907e2ec6337f61b20bfdd4b184ff4d3838a84097353c8d7bf21a3e9751b1a7e1af0fae704c39aed1c683bbc1b9151351e246e91ac604

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Computer.txt
      Filesize

      305B

      MD5

      266d15acb349cd5213c897b54d0239fb

      SHA1

      247bf018647b4885c5fef51dc1a8de1a76b84ef3

      SHA256

      818676c58291d22b9bfc907f70bb42c7b01e449499e885c8d9e9abf650b9acd1

      SHA512

      15c4b7bf5ec5d121e29e2361f57ef96570ee3dd948819d55fd666f77ffe8fea75596f6d21cdb2cc9e225e493bb8ba582ebdf2ca0970b71de0fa9fcb89548ad3f

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Grabber\ExitConvertFrom.doc
      Filesize

      408KB

      MD5

      a3f08cfd6cacc94e4bc5d390deb99116

      SHA1

      6ee1aed96f65a1dea10443f87915854995d8ee0c

      SHA256

      12247cb34209df36b80138a1e6c0c48a70eb748a16801d3a06f437a1016d0e43

      SHA512

      65df0c6807f901df8d39e05bd6e402ae4263440835b66618df9922bf31f95a4659fa852d2a3b4b897135ac358b10c3ae5e92c6f1b6a7f7afa5fdde9a8fc0d4e6

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Grabber\MoveResize.doc
      Filesize

      255KB

      MD5

      7f2ec1b6cb3be79f1894d1e3c47ad2a2

      SHA1

      0a6d71efdbaf6e56d342107b74d8d0505c8ecf90

      SHA256

      b819615a2b05843c6e17e2dea17ae4707e6e7c31cdb9b6ffa986a0ddb9bae2d3

      SHA512

      5691f022e928f3f3bee5e99fefba503d0bbb9fe96b827f30da704677161dbea41014d7e610025660c275f2306ad99d00aebb831c4d9c0dfb02cdfb9a38495b6f

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Grabber\ResolveMove.zip
      Filesize

      328KB

      MD5

      066c0ef7dd1a80b3b26fe3d3a92e68db

      SHA1

      eebe5945dca22080d6a0418529354d2efc718a79

      SHA256

      981cada2156762c51f1cb832c419775eb68004151a7fae6c6bdfd8c154db37ea

      SHA512

      bd56fdf8abd826efc14b312a38436c1d19aa51cc82d22f69e454ade1ef124a51ae20fdd8a594645dc029fd2afe5f981c506e921aa4f4636248bf1de283ab8615

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Processes.txt
      Filesize

      904B

      MD5

      25f30e9a59c7f343b6f71e94d3f37cf1

      SHA1

      a00c04b48331b6c056efa2aa3ee8851fd55fff76

      SHA256

      41440f05f77221489997d2a9ff5adc252e63f49871f07b939d2e85d4d06489cd

      SHA512

      77da0a0784b2672027ba5f7a7b128e0911f662dc8df431cd8cfbf41495e75f9e92f94ca624b90e9f793bcbdc69ad1ebdacc663491894b7e994fef8a8556c690e

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Processes.txt
      Filesize

      1009B

      MD5

      fb0b5ae55b2e740c2c12d3b97421635c

      SHA1

      799bc287100957c2d0e0c0de6ca580f85b1a95fa

      SHA256

      0e19a6a70e6fdd0c50705c3276bab468f2427c126b449d00e8f7a3c99baa864b

      SHA512

      57a68727eb183e8ededc1a829d6f994ff1f2a66379549073ca2d295c53dd03a4988192049ecec046c37da5e2b6f264405a770b82a15bae79f19d9f289f357b62

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Processes.txt
      Filesize

      947B

      MD5

      f363f4b45ebf407dc94d11c89082abf2

      SHA1

      bab40c3d99f9f383e18606b39a3017ad9a0689cc

      SHA256

      866b6cadbe5e1c0419b9e2bfbc36728e9d07891cf832ca0e3acb5056a03c507f

      SHA512

      f13cebb4c092b2dc12faae8fed1dbdeaca33e2b2f459f18c362b0828c7a65264d741fda83ad2f696563655e58d87ce007cf70cd2d7ca2173cf2f856685cbb502

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Processes.txt
      Filesize

      913B

      MD5

      0107086374468265649cc12d41565907

      SHA1

      cbdbe798933fa9064abe237b3c0ecb30b7b53bb0

      SHA256

      3cd127d9b19a38292ff1924835112701df237622e8f06f51ff344e67e79b362f

      SHA512

      9c5c4b84fac450ee4fd98784ca1a0796cd9c32a010ab2f41eb54bdb2b946b108075960167252c5a7918926e72f15b408e4a77e0c5187529a5bde496ba730fde5

      Download Submit

    • C:\Users\Admin\AppData\Local\yDRwBVuLXyDuLyJBNHTX078BFBFF000306D2A4B55DEC79\79078BFBFF000306D2A4B55DECyDRwBVuLXyDuLyJBNHTX\Screenshot.Jpeg
      Filesize

      79KB

      MD5

      7a052c880b30159beb35befc7f0c68e8

      SHA1

      a7faf08a834c41578a0c245b7daea7f256aa594d

      SHA256

      1841bf218c3264129f9d3a185819d7d7000e8fef1ff1729d147243e240a65eb0

      SHA512

      6c5c3dce0f5829cf7f7cb3e9601baf6a1c43cdd36e08b3236e0ddfa444c69bbf36be527d73eb0466c4f9cb9da4fcd712aceffa47af430b2f41a454dad26473e4

      Download Submit

    • memory/1652-0-0x00000000004D0000-0x0000000000656000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1652-2-0x0000000002770000-0x0000000002780000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1652-1-0x00007FFE93CE0000-0x00007FFE947A1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1652-3-0x000000001B940000-0x000000001B9B6000-memory.dmp

      Filesize

      472KB

      Download

    • memory/1652-277-0x0000000002770000-0x0000000002780000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1652-276-0x00007FFE93CE0000-0x00007FFE947A1000-memory.dmp

      Filesize

      10.8MB

      Download