Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 19:42

General

  • Target

    e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe

  • Size

    444KB

  • MD5

    e5b5eb1e61978a8f757c7011f5949959

  • SHA1

    7203c7048d1e3e4556fd3c45f53a7edf91ba34d9

  • SHA256

    6bd8dfbc8c83fee901bf74160ed87fd28ace9d358982634287d199b550e31edd

  • SHA512

    c7c3b4392108fd2379534a93eaf30f74a5a89d230d19c255e8f0911c6bf1c8ecbf787bc406a481692f6c9e47550505e451baebaebed548e2803e2ad1631cf0ab

  • SSDEEP

    6144:nttttVkssroWoQTX5pS9t7RyBTBZEbv5QttttVkssroWoQTX5pS9t7RyB6:lkss8WBTGv5ekss8WB6

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:4552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\905c0769f9a06c95a24ddf945\patcher.exe

    Filesize

    888KB

    MD5

    8782d0a789c88bf6c3dba1ff251f1c29

    SHA1

    3e895d543c6124e280285282fb4f80804babd015

    SHA256

    d6d6a2c96e6d92c0a4d9fbb3dae2eeacd02bdfbc30a0991000c9f7683b90c216

    SHA512

    12ee7138c9466da6b4738c7d3f9e946f4288eb85a1fe90f89cf784a62a6b1e9b72e91ce104ce7b29df95a561e2694c4b59cc3c772b79bf4e95221066bcfe49d8

  • memory/4552-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4552-1-0x0000000000680000-0x0000000000683000-memory.dmp

    Filesize

    12KB

  • memory/4552-842-0x0000000000680000-0x0000000000683000-memory.dmp

    Filesize

    12KB