Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 23:03
Behavioral task
behavioral1
Sample
e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe
-
Size
40KB
-
MD5
e60f966fdfe8bad85efc44876c9517df
-
SHA1
88032528770a299d936762da632052adea705393
-
SHA256
ec43eb9d66a1c891a7a32eb5610b23cd1e04cf41e2621c6497379c2d1c96310b
-
SHA512
5be10b9595f3fb19dbed1ba5fea3c9d147cc0ba4dc55d613d054b336d0bfeecac492cd9933f76bab197120c84173fa8abbfdfdd05316783b7b7b601c14a41bca
-
SSDEEP
768:orY0THZVdBsAs2H1FuIDKdLtZ1UKnU83YjtxW34:lCZVgAs6oQKdLtTUut36tA34
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
Processes:
e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe:*:Enabled:ldrsoft" e60f966fdfe8bad85efc44876c9517df_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2296-1-0x0000000000400000-0x000000000143B000-memory.dmp upx behavioral1/memory/2296-0-0x0000000000400000-0x000000000143B000-memory.dmp upx behavioral1/memory/2296-2-0x0000000000400000-0x000000000143B000-memory.dmp upx behavioral1/memory/2296-3-0x0000000000400000-0x000000000143B000-memory.dmp upx behavioral1/memory/2296-7-0x0000000000400000-0x000000000143B000-memory.dmp upx behavioral1/memory/2296-11-0x0000000000400000-0x000000000143B000-memory.dmp upx behavioral1/memory/2296-15-0x0000000000400000-0x000000000143B000-memory.dmp upx