Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 05:11

General

  • Target

    dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    dc13d24e056c80813c44d68d54af8cfd

  • SHA1

    a9f34ebe418d9efcb517f077cc2f965e2d6c9a34

  • SHA256

    7b014711b716b2b4258214c6a4e2a2643d29403371dbcd717bd042d391299d7d

  • SHA512

    3da4f732958683ccd96f24545e2c18ef72e6db3e36c1e8e8289c72cada165a7fab93cabf5989730478725a95f42f99a146299dbaeb488a441e4cc5ee6b89a30e

  • SSDEEP

    1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitiF4GQadCh:qKtfDwsjPThTYszDH2fDGhu

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FF5.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"
            4⤵
            • Executes dropped EXE
            PID:1432
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2508

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\7-Zip\7zFM.exe

            Filesize

            989KB

            MD5

            6f1d1fa4eebaf55531b107d0cede0945

            SHA1

            f659488b079270563a08968ebcbcb6d4ba9abec8

            SHA256

            4328b24e4273afefe2c1e11ab1c8d1080e1f36bac1ad506cc6f486c15ee65fc4

            SHA512

            e45e78e47699aa14f0b83c234b0a8095232f48be713f82c81ca07a014b9c5fc180db6ebcd7e48716a3852c6c9dc19d03d84f90a339f20427fd6114330d13c012

          • C:\Users\Admin\AppData\Local\Temp\$$a4FF5.bat

            Filesize

            614B

            MD5

            decbfff3afc5024361240f9397ea1379

            SHA1

            00f5f841de2ecedfde30ea01bd1ca0ebb0074771

            SHA256

            caf195d9e5ff28e52d9a9e41417c2c483e13c1eed2b9dfe792b33dbb26c50235

            SHA512

            cd9775fb8c4d4b8361e2a84460719d5d827e32f15677904ac604badca731e248588194ae74f40821f96864a232d79fc3fd338d624597292e3e036101128ff574

          • C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe.exe

            Filesize

            14KB

            MD5

            bde3ac1c9b09fc1b55c6e398009a9c83

            SHA1

            fa99711be9d0812383d1f41e9277bd3ba71eb09f

            SHA256

            059263f4b3635da33f1bae9789b13f287bce7b8dedc960201e8807e6de9b3fc5

            SHA512

            af2ff4728885c6319800f98f4f639f836eb4713272d3dbf38c5f473b91b398747ce6bdc56d32cd0fc2ddc88f3ba1b99e170e6f679341d4c3e5a9eafaf3930e99

          • C:\Windows\Logo1_.exe

            Filesize

            58KB

            MD5

            a7dcffd56f068633bfaf85ec3d65d08b

            SHA1

            36cba2a5522ebd673107d63f9d8e1afbdfa236b6

            SHA256

            409f7415b7b10f6d801014ac6b0e3cea785ad5a73ba397f46765bbd3dcf36367

            SHA512

            78dc44535430d92307bfbd5b679159f7032306f3f818b0d5a3264347c227bd8edd0ae07bd9f6beaf91c33ee81a451d01177d08c254ace779dfd66ab9666bf6d1

          • memory/624-7-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

          • memory/2508-223-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB