Overview

overview

7

Static

static

3

ecaed2614a...18.exe

windows7-x64

7

ecaed2614a...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ecaed2614ac73425d6f09d5232d2ee64_JaffaCakes118.exe
  • Size 249KB
  • Sample240411-e8w9xsff3z
  • SHA256 8f39a8855068f84bbaa8131a71cc2c3217bbb7e279702918d7305d2bb8c29126
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealerupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecaed2614ac73425d6f09d5232d2ee64_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ecaed2614ac73425d6f09d5232d2ee64_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\50e7e04c8df96.exe
      .\50e7e04c8df96.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:212
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3888

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          uninstall.exe
          • Path C:\ProgramData\Zoomex\uninstall.exe
          • Size 48KB
          • SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bootstrap.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\[email protected]\bootstrap.js
          • Size 2KB
          • SHA256 8d8d07f18bb4291482a4b6741e6f396cba858c844da50c708209bd7712f5412d
          • MD5 SHA1 SHA512
          Submit Download

          chrome.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\[email protected]\chrome.manifest
          • Size 116B
          • SHA256 25d43d3a2c82640394e712be291a15886e4e39f20754a6a28d07e343bbfb6fbb
          • MD5 SHA1 SHA512
          Submit Download

          bg.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\[email protected]\content\bg.js
          • Size 8KB
          • SHA256 93eecc33b60e3f7b0edb4d80ee35cd2e356301926bb6d3f815296f97ef9156cc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zy.xul
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\[email protected]\content\zy.xul
          • Size 225B
          • SHA256 483d9e03de12fd13abdb06740d5e0e755a7ca6662f58a5147f464b75221d226f
          • MD5 SHA1 SHA512
          Submit Download

          install.rdf
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\[email protected]\install.rdf
          • Size 700B
          • SHA256 e71e0dba9283c9d662923703b3ff30e0d2ea80f0a2cefb92cb260cd6439da833
          • MD5 SHA1 SHA512
          Submit Download

          50e7e04c8df96.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\50e7e04c8df96.exe
          • Size 71KB
          • SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          50e7e04c8dfcf.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\50e7e04c8dfcf.dll
          • Size 115KB
          • SHA256 73c44d8943947e3cf9ecabdeea4d9a37652614f5490a1f972816be4123795125
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          50e7e04c8dfcf.tlb
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\50e7e04c8dfcf.tlb
          • Size 2KB
          • SHA256 a602c790bcf424c154a082a88a495b256dd5456f627943568c358c74f606c568
          • MD5 SHA1 SHA512
          Submit Download

          50e7e04c8ddb18.83696850.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\fmehlddjehhhihdmaopjdmfmgfmghifm\50e7e04c8ddb18.83696850.js
          • Size 4KB
          • SHA256 bda94f9fa3eea17c78fd8a3590f710b4ce63b58fb33f6e8f25d1bf81506a1419
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          background.html
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\fmehlddjehhhihdmaopjdmfmgfmghifm\background.html
          • Size 161B
          • SHA256 25417ddecdb2eccd0d79d4350df19161d2554f53e1a656a1f361fc60bf76366d
          • MD5 SHA1 SHA512
          Submit Download

          content.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\fmehlddjehhhihdmaopjdmfmgfmghifm\content.js
          • Size 197B
          • SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
          • MD5 SHA1 SHA512
          Submit Download

          lsdb.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\fmehlddjehhhihdmaopjdmfmgfmghifm\lsdb.js
          • Size 559B
          • SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
          • MD5 SHA1 SHA512
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\fmehlddjehhhihdmaopjdmfmgfmghifm\manifest.json
          • Size 475B
          • SHA256 5ac43caaa60d48d2c5bc8059dc845eb344b31c088207c8da714f7a36d500c69e
          • MD5 SHA1 SHA512
          Submit Download

          sqlite.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\fmehlddjehhhihdmaopjdmfmgfmghifm\sqlite.js
          • Size 1KB
          • SHA256 cd74d292314ba191cd88c343749cfb6d956f02bf73fabdfbea8f18a3028b79d3
          • MD5 SHA1 SHA512
          Submit Download

          settings.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7zS80D8.tmp\settings.ini
          • Size 7KB
          • SHA256 a101e7c346329eb036521ade4a26ae0d10e2b73303780c8dffde4313c29eee44
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          UserInfo.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd82AE.tmp\UserInfo.dll
          • Size 4KB
          • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
          • MD5 SHA1 SHA512
          Submit Download

          nsJSON.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsd82AE.tmp\nsJSON.dll
          • Size 7KB
          • SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/212-79-0x0000000073E40000-0x0000000073E4A000-memory.dmp
          Download