Overview

overview

7

Static

static

3

e5e5e1bb56...18.exe

windows7-x64

7

e5e5e1bb56...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    115s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 21:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e5e5e1bb569bc280bee86dbb88e83f01_JaffaCakes118.exe
  • Size 249KB
  • Sample240407-1dqdsafc78
  • SHA256 02b4deaea40db2c03348c2ed2befa96105a871e2fcc65ff2421a2d4d635b1581
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealerupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5e5e1bb569bc280bee86dbb88e83f01_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e5e5e1bb569bc280bee86dbb88e83f01_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\50e538fc9cd69.exe
      .\50e538fc9cd69.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2696
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3004

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          uninstall.exe
          • Path C:\ProgramData\Zoomex\uninstall.exe
          • Size 48KB
          • SHA256 43c3e8d7aa00a299f084db17e384aa96de508565f82264ee88bd9c7647fa9fc9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bootstrap.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\[email protected]\bootstrap.js
          • Size 2KB
          • SHA256 fc47282537c3276f070d720b21ab96bbb07cdefe233e67e317439c00466927e4
          • MD5 SHA1 SHA512
          Submit Download

          chrome.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\[email protected]\chrome.manifest
          • Size 116B
          • SHA256 a803b54d69363048e9599119f9f32aa9de7a025d680a0dddf2033ff69be7c00c
          • MD5 SHA1 SHA512
          Submit Download

          bg.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\[email protected]\content\bg.js
          • Size 8KB
          • SHA256 17a9e45dab6710e251d524eaa9ead9c5e643527fdc1503256737b9bdb195755d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zy.xul
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\[email protected]\content\zy.xul
          • Size 225B
          • SHA256 076c2390125ba6c73dcdefc512a8dcf7489a28d4cc244915965a4e7b656fe920
          • MD5 SHA1 SHA512
          Submit Download

          install.rdf
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\[email protected]\install.rdf
          • Size 700B
          • SHA256 04b48b3d5f3d11b5bd2f8ec46dee4313a98c00dee66399ada344a469fe3af6da
          • MD5 SHA1 SHA512
          Submit Download

          50e538fc9cd69.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\50e538fc9cd69.exe
          • Size 70KB
          • SHA256 5e74f0e710c067ad82301c7c14ed6afb138f974f351042cfe0ecd275cea2612c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          50e538fc9cda2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\50e538fc9cda2.dll
          • Size 115KB
          • SHA256 73c44d8943947e3cf9ecabdeea4d9a37652614f5490a1f972816be4123795125
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          50e538fc9cda2.tlb
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\50e538fc9cda2.tlb
          • Size 2KB
          • SHA256 a602c790bcf424c154a082a88a495b256dd5456f627943568c358c74f606c568
          • MD5 SHA1 SHA512
          Submit Download

          lllmkgojnmeaabdngcojfpfmbhmpohko.crx
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\lllmkgojnmeaabdngcojfpfmbhmpohko.crx
          • Size 8KB
          • SHA256 27cfc50e467e8bcd4d3c0add4bdfc0baf67cba2c79a65da61efb4852db786d7c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7zS6978.tmp\settings.ini
          • Size 6KB
          • SHA256 318ebad3efd7c844b044ede27ec3429b32e0ecb918bf239762bf323f876c997f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          UserInfo.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsp6BEA.tmp\UserInfo.dll
          • Size 4KB
          • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
          • MD5 SHA1 SHA512
          Submit Download

          nsJSON.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsp6BEA.tmp\nsJSON.dll
          • Size 7KB
          • SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2696-52-0x00000000741E0000-0x00000000741EA000-memory.dmp
          Download