Overview

overview

8

Static

static

3

b3decd1180...18.exe

windows7-x64

7

b3decd1180...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 08:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b3decd118032e5f6b4486b7281474454_JaffaCakes118.exe
  • Size 568KB
  • Sample240404-km5l3abb68
  • SHA256 74cb6bd4bf1ad85a26043f406c34f4a5f6e83e5908441066b0892058c6e7a926
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Contacts a large (917) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3decd118032e5f6b4486b7281474454_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b3decd118032e5f6b4486b7281474454_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2396

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Size 471B
        • SHA256 8a8a1c2115ea90a574a9117e799089b0445155b5d8b4f361e3c840fcb64c9377
        • MD5 SHA1 SHA512
        Submit Download

        7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Size 404B
        • SHA256 e8d543041448c0d65c0a6c199e2c9f31d995bcb7bfb4706fa63911981d603d65
        • MD5 SHA1 SHA512
        Submit Download

        suggestions[1].en-US
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\suggestions[1].en-US
        • Size 17KB
        • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        office2016setup.exe
        • Path C:\odt\office2016setup.exe
        • Size 5.6MB
        • SHA256 df4bda47d86cca8c0c599ca3547ff62ef3fc1d0f462e6d3a87a454b60e302ccc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download