Analysis
- max time kernel
119s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
07/04/2024, 19:00
General
- Target e5a27b94db730d5196a5f8828f59009d_JaffaCakes118.exe
- Size 1.2MB
- Sample240407-xnrstaca49
- SHA256 b862e8739fe8bf1a88a8a9b22b7b173bbdcafd12c580b27ed7e1732679838d94
Malware Config
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 6 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5a27b94db730d5196a5f8828f59009d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5a27b94db730d5196a5f8828f59009d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5a27b94db730d5196a5f8828f59009d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5a27b94db730d5196a5f8828f59009d_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 16243⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1664-22-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/1664-1-0x00000000010A0000-0x00000000011D0000-memory.dmp
memory/1664-2-0x0000000004AB0000-0x0000000004AF0000-memory.dmp
memory/1664-3-0x00000000005B0000-0x00000000005CC000-memory.dmp
memory/1664-4-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/1664-5-0x0000000004AB0000-0x0000000004AF0000-memory.dmp
memory/1664-6-0x0000000005C80000-0x0000000005CFC000-memory.dmp
memory/1664-7-0x0000000000C80000-0x0000000000CCC000-memory.dmp
memory/1664-0-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/2652-8-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2652-12-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2652-14-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2652-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2652-17-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2652-19-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2652-21-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2652-23-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/2652-10-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2652-24-0x00000000005C0000-0x0000000000600000-memory.dmp