Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08-04-2024 17:30
General
-
Target
e8052fbfd02396ef04a3814d2d51fd63_JaffaCakes118.exe
-
Size
862KB
-
MD5
e8052fbfd02396ef04a3814d2d51fd63
-
SHA1
42ce5b397f41adbf269a2c61be70beb6a7359c00
-
SHA256
b0d20d8700427289263c80f1dc04b6c85b7d124738f07b02a5bdde5e6931198e
-
SHA512
ce84cc891c0abbb77b9a41882f926bb49dbcd87e9f703e3bd1f915127b0d8324cd25a4dedbfa64540825d36823247e3cdb4f3d7e3c75cc8a5914dd8fb3f3a8e2
-
SSDEEP
12288:/w4EnzBt2pFz9Kq3Y6GmDhUqFccF0KJA4rekVaYkIiL5lWGbAMrExsM7aVyLPFPI:EGpFJKqe8cc7A4reKxfOWGHm7lPt
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8052fbfd02396ef04a3814d2d51fd63_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8052fbfd02396ef04a3814d2d51fd63_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Antivirus2008y\e8052fbfd02396ef04a3814d2d51fd63_JaffaCakes118.exe"C:\Program Files (x86)\Antivirus2008y\e8052fbfd02396ef04a3814d2d51fd63_JaffaCakes118.exe" /d:C:\Users\Admin\AppData\Local\Temp\e8052fbfd02396ef04a3814d2d51fd63_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
862KB
MD5e8052fbfd02396ef04a3814d2d51fd63
SHA142ce5b397f41adbf269a2c61be70beb6a7359c00
SHA256b0d20d8700427289263c80f1dc04b6c85b7d124738f07b02a5bdde5e6931198e
SHA512ce84cc891c0abbb77b9a41882f926bb49dbcd87e9f703e3bd1f915127b0d8324cd25a4dedbfa64540825d36823247e3cdb4f3d7e3c75cc8a5914dd8fb3f3a8e2
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB