Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 22:27
Static task
static1
Behavioral task
behavioral1
Sample
e6002162f961fccb720de43120de00d6_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e6002162f961fccb720de43120de00d6_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
e6002162f961fccb720de43120de00d6
-
SHA1
230082005dea8730637d0139d65e05a057c47219
-
SHA256
d7316147eebe9516b3270a0db0f6115946cbf16c7481b3a1c3559ba9467ea912
-
SHA512
e7c1a43b1ccb9575f9c8f4409e5d92c8b4acde473b35dc88bdbb605944d25cbeed2d2c698f5a6e4235cbc6e343d21994b9dac1824e2c1582f4ac2a47251aa4eb
-
SSDEEP
24576:tDbtrJZ5HAlzh3psjXEuMPBbQCnoVFrfFku+otcsrJsC:nz5glzh52EuMlQLVFrGot1rJs
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/858957282438938625/3kCjQ4X7YW4TW7DTgUtbmym8GLG7UL3BOSBerPvdbDKL2ADHt7MRoSh9PuPhgf460TIb
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 freegeoip.app 5 freegeoip.app -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
e6002162f961fccb720de43120de00d6_JaffaCakes118.exepid process 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
e6002162f961fccb720de43120de00d6_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier e6002162f961fccb720de43120de00d6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e6002162f961fccb720de43120de00d6_JaffaCakes118.exepid process 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e6002162f961fccb720de43120de00d6_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e6002162f961fccb720de43120de00d6_JaffaCakes118.exepid process 1968 e6002162f961fccb720de43120de00d6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6002162f961fccb720de43120de00d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6002162f961fccb720de43120de00d6_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\44\Browsers\Firefox\Bookmarks.txtFilesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\ProgramData\44\Process.txtFilesize
411B
MD58a1f52495f76f991e2943e13ae42b188
SHA14eb81aaa198b54b39298aef7da8895771d49845e
SHA2564ab50c5450df7964ef27e1c74238656d4b681ab031e80ed32af5ba099dc9342a
SHA51269d802c9b163441b2f9534574774c5403eecdc4049736379e4d1ef5d3dce719fa2479f6a5cce902994a6aa1a024b93089f5f7feb642085e92a48267eb2c08fc3
-
memory/1968-0-0x0000000000340000-0x00000000006EE000-memory.dmpFilesize
3.7MB
-
memory/1968-2-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB
-
memory/1968-1-0x0000000000340000-0x00000000006EE000-memory.dmpFilesize
3.7MB
-
memory/1968-3-0x00000000058E0000-0x0000000005920000-memory.dmpFilesize
256KB
-
memory/1968-54-0x0000000000340000-0x00000000006EE000-memory.dmpFilesize
3.7MB
-
memory/1968-55-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB