Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 05:34

General

  • Target

    dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe

  • Size

    90KB

  • MD5

    dc82b95bc77bd7adf65a776e2252a799

  • SHA1

    45bff1aecaaee83e46b00546c1547f9ec00130db

  • SHA256

    ca3a63446d2d40562b1f0ec100d29effb5a004e747c3ac0236f6e8eb9c63a93a

  • SHA512

    6c43ac9aa64c4e482fcb181675689366a72c4d06b8165f42d2b558543d63428f9e7d3a6caf91770928e87c6bb7769a03f766507d7428b26d9c02b1ab2f3c34dd

  • SSDEEP

    1536:NdF6Y9JIXfLrhoCQISaS86P9cPGK7v4Bv1HQ2YmK:NR2FoCQaS8y9cPz4BvFQH

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: RenamesItself
    PID:1524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

          Filesize

          1.6MB

          MD5

          bc5cd02ddb97cbcde8f0505c8ec2753b

          SHA1

          580a305ccc2bf18e1e1bb9e3a8542ea6cd2e845a

          SHA256

          a82bd6d2371ddfe74bb4649b9b23dd50d236543079c9e24ba3fef1e9859ec3a6

          SHA512

          89cdc6ee84e355667a104e82b43825a88edfacd13b904ed5a4f92535ddfb6583620ec036181be28a9b4eaadaf48d33787da5fc917a4cd593cfc2fc1906c97d14

        • C:\Windows\SysWOW64\UsaShohdi.asu

          Filesize

          90KB

          MD5

          a6bf392e65fafb41cf9d2730e131bc8d

          SHA1

          533fb00e00d775dfc34613c43134ece06eff22b1

          SHA256

          7df75c216cf38121a016c946eca3e6ab971ff997e6b2dbf546048f6948d2f44c

          SHA512

          3a976d027c725653ddd10df49fe843f1859db31509472b755837acc754ef513ef5eb8c938c9d103e7425edcdf5aef3632020d9fd10f0ed9a0a724cc748ed0446