Analysis

  • max time kernel
    99s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 19:32

General

  • Target

    a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe

  • Size

    128KB

  • MD5

    a4b5c85d53120079a9bb9e54b1ff8a9b

  • SHA1

    ab24b7b9aa8b7d2a033f11e06b03d12a8a0dc9e6

  • SHA256

    e0653dc038521d02b48f6e69f3b62836d87eb4b4305e6a5f4540ad72b7cb5103

  • SHA512

    6ed9e3b01388081cd78efae44347bc67d566f9e7b5571d9c0bc616dcec836c066a3c00fa2470d9bb80c991953f16f12888eb1ea42d680bf46a3677b6b29d2643

  • SSDEEP

    3072:D6Oc3xxNSDrf8jV09T5oTrREqu6QlOiVBav09T5o:D6Oc3xzSI69dofRTCOinaM9do

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Windows\outlook.exe
      C:\Windows\outlook.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:4388
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 29868
        3⤵
        • Program crash
        PID:720
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4388 -ip 4388
    1⤵
      PID:2280

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\outlook.cfg

            Filesize

            2KB

            MD5

            d2093a543cecc7ce23df422c9baa662a

            SHA1

            d4006a024e839dc6c405865a99031e1faf4aa91a

            SHA256

            3108a746201a9c58797d2ede4c27879a806f73024dbff9a47b38a1ab2738d04e

            SHA512

            51a08dded07a7cff6b7969b79cafe3ce5533aa90450c56e75101061dd3a74a173e8574dccec13fc9f7d80790d3e6110d8367f50079b4e6f3a668f27e651ca6b9

          • C:\Windows\outlook.cfg

            Filesize

            737B

            MD5

            12237054cc8238d84b88008e1c1006e2

            SHA1

            65d7b196d91bae9ce7ab22e1dbacbd5c1b1948a3

            SHA256

            96acb3266157d6bb005803dc626c192ab8248db4d8d233de8b716d21bc552ab7

            SHA512

            74172dbae4452eac43390eecebc0888ee1b586df23252b372e85106f999004b12796221b31cfb7ce2a712dd9fe93be8529276dc97159d7afb149e800dc5cfdb9

          • C:\Windows\outlook.cfg

            Filesize

            1KB

            MD5

            0aaa44531a2e47cbfa8111c6aacdffcd

            SHA1

            b1b8f2d32fd4413a80add3dbf931c8ee3c60e53c

            SHA256

            48af9029977a0db8ba033edf2bea30496473f8ca065cdb742591f630d2d6ccdc

            SHA512

            26bd225853ac962e59bea6aff56733a7efc1f632bda128e8460481563254ec117982897cf0685276e40d5fcc3632e59e1319f1dcc57317ec80cf8a4a4d141fb3

          • C:\Windows\outlook.exe

            Filesize

            49KB

            MD5

            0e9379e357aba95f8b9883af9b67675e

            SHA1

            280a174a414e5b8588f42b6328af2c8c8ff4394f

            SHA256

            96b9c4ead67d03eb2c69103a983274e013e3466e80d8f95bd7cf3aea8be05b28

            SHA512

            6cc383806882729cd889b025802ac0d5e1c55a74b3e7d7c98932644e8802fe52b5b14a886eff70ab7deaa70fb60bb9898e55b5cd83b5b99e2a2d107dce367784

          • memory/3440-0-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

          • memory/3440-18-0x0000000000400000-0x000000000040C000-memory.dmp

            Filesize

            48KB

          • memory/4388-102-0x0000000000400000-0x000000000047E000-memory.dmp

            Filesize

            504KB

          • memory/4388-118-0x0000000000400000-0x000000000047E000-memory.dmp

            Filesize

            504KB