Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:03

General

  • Target

    e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    e60f966fdfe8bad85efc44876c9517df

  • SHA1

    88032528770a299d936762da632052adea705393

  • SHA256

    ec43eb9d66a1c891a7a32eb5610b23cd1e04cf41e2621c6497379c2d1c96310b

  • SHA512

    5be10b9595f3fb19dbed1ba5fea3c9d147cc0ba4dc55d613d054b336d0bfeecac492cd9933f76bab197120c84173fa8abbfdfdd05316783b7b7b601c14a41bca

  • SSDEEP

    768:orY0THZVdBsAs2H1FuIDKdLtZ1UKnU83YjtxW34:lCZVgAs6oQKdLtTUut36tA34

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe"
    1⤵
    • Modifies firewall policy service
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2296-1-0x0000000000400000-0x000000000143B000-memory.dmp

    Filesize

    16.2MB

  • memory/2296-0-0x0000000000400000-0x000000000143B000-memory.dmp

    Filesize

    16.2MB

  • memory/2296-2-0x0000000000400000-0x000000000143B000-memory.dmp

    Filesize

    16.2MB

  • memory/2296-3-0x0000000000400000-0x000000000143B000-memory.dmp

    Filesize

    16.2MB

  • memory/2296-7-0x0000000000400000-0x000000000143B000-memory.dmp

    Filesize

    16.2MB

  • memory/2296-11-0x0000000000400000-0x000000000143B000-memory.dmp

    Filesize

    16.2MB

  • memory/2296-15-0x0000000000400000-0x000000000143B000-memory.dmp

    Filesize

    16.2MB