Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 07:29
Static task
static1
Behavioral task
behavioral1
Sample
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/olldmhffoaz.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/olldmhffoaz.dll
Resource
win10v2004-20231215-en
General
-
Target
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe
-
Size
479KB
-
MD5
864c6461a405628b69fb52e1cad9d845
-
SHA1
bd92998beb96c5bbc013326b4e9f97aa71b0da07
-
SHA256
33b266ec8faff2cef0a77d1c0ea818608764a2c2c0d8350911d50ab8266ab9dc
-
SHA512
927cc76cb6c9d525e540ea3aec0606020dbf8bea309bd08cdf29adfc49a7e0c1043eb9dadef596b537b0322e37c395cf75433967e952a20d76d3683885c3bedf
-
SSDEEP
12288:ysOZAy3/0P5tMqm3aCc+MWSk8xewTFSNgMliFl:Pyp/E5tMKCc+Mvk8xeWFSN3il
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Loads dropped DLL 1 IoCs
Processes:
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exepid process 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exedescription pid process target process PID 1660 set thread context of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exepid process 2960 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exedescription pid process target process PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe PID 1660 wrote to memory of 2960 1660 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe 864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyEC1.tmp\olldmhffoaz.dllFilesize
22KB
MD5374e00e1b931d7e06c74d4ce9c9476a3
SHA15f199903f9b64b10e218b4d98621f7c2b02b11d9
SHA25680f175c88444e4c1388bdc3560f9c44b9fb3a24861f20bbedab4b5dfd69d10ef
SHA512470793bc592c7ec78cc1dec91ebe48d6136c60d179512782b8b41532d372a8293c53913653931b3c74d1544fb038e1fc649cac745bd65310c1ffc88606350ad4
-
memory/1660-7-0x0000000010000000-0x0000000010009000-memory.dmpFilesize
36KB
-
memory/1660-11-0x0000000010000000-0x0000000010009000-memory.dmpFilesize
36KB
-
memory/2960-9-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2960-12-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2960-15-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2960-16-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB