Analysis
-
max time kernel
99s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe
-
Size
128KB
-
MD5
a4b5c85d53120079a9bb9e54b1ff8a9b
-
SHA1
ab24b7b9aa8b7d2a033f11e06b03d12a8a0dc9e6
-
SHA256
e0653dc038521d02b48f6e69f3b62836d87eb4b4305e6a5f4540ad72b7cb5103
-
SHA512
6ed9e3b01388081cd78efae44347bc67d566f9e7b5571d9c0bc616dcec836c066a3c00fa2470d9bb80c991953f16f12888eb1ea42d680bf46a3677b6b29d2643
-
SSDEEP
3072:D6Oc3xxNSDrf8jV09T5oTrREqu6QlOiVBav09T5o:D6Oc3xzSI69dofRTCOinaM9do
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4388 outlook.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\sys32.exe" a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\outlook.cfg outlook.exe File created C:\Windows\crc32.cfg outlook.exe File created C:\Windows\sys32.exe a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe File created C:\Windows\outlook.exe a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe File opened for modification C:\Windows\outlook.exe a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe File opened for modification C:\Windows\sys32.exe a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 720 4388 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3440 wrote to memory of 4388 3440 a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe 86 PID 3440 wrote to memory of 4388 3440 a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe 86 PID 3440 wrote to memory of 4388 3440 a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4b5c85d53120079a9bb9e54b1ff8a9b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\outlook.exeC:\Windows\outlook.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 298683⤵
- Program crash
PID:720
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4388 -ip 43881⤵PID:2280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d2093a543cecc7ce23df422c9baa662a
SHA1d4006a024e839dc6c405865a99031e1faf4aa91a
SHA2563108a746201a9c58797d2ede4c27879a806f73024dbff9a47b38a1ab2738d04e
SHA51251a08dded07a7cff6b7969b79cafe3ce5533aa90450c56e75101061dd3a74a173e8574dccec13fc9f7d80790d3e6110d8367f50079b4e6f3a668f27e651ca6b9
-
Filesize
737B
MD512237054cc8238d84b88008e1c1006e2
SHA165d7b196d91bae9ce7ab22e1dbacbd5c1b1948a3
SHA25696acb3266157d6bb005803dc626c192ab8248db4d8d233de8b716d21bc552ab7
SHA51274172dbae4452eac43390eecebc0888ee1b586df23252b372e85106f999004b12796221b31cfb7ce2a712dd9fe93be8529276dc97159d7afb149e800dc5cfdb9
-
Filesize
1KB
MD50aaa44531a2e47cbfa8111c6aacdffcd
SHA1b1b8f2d32fd4413a80add3dbf931c8ee3c60e53c
SHA25648af9029977a0db8ba033edf2bea30496473f8ca065cdb742591f630d2d6ccdc
SHA51226bd225853ac962e59bea6aff56733a7efc1f632bda128e8460481563254ec117982897cf0685276e40d5fcc3632e59e1319f1dcc57317ec80cf8a4a4d141fb3
-
Filesize
49KB
MD50e9379e357aba95f8b9883af9b67675e
SHA1280a174a414e5b8588f42b6328af2c8c8ff4394f
SHA25696b9c4ead67d03eb2c69103a983274e013e3466e80d8f95bd7cf3aea8be05b28
SHA5126cc383806882729cd889b025802ac0d5e1c55a74b3e7d7c98932644e8802fe52b5b14a886eff70ab7deaa70fb60bb9898e55b5cd83b5b99e2a2d107dce367784