Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 09:42

General

  • Target

    f7bbc60071623219f622b4e17e1f9cdc_JaffaCakes118.exe

  • Size

    197KB

  • MD5

    f7bbc60071623219f622b4e17e1f9cdc

  • SHA1

    cb11c5dc4a18271b5c1317d5117e6da8346975fc

  • SHA256

    181e46988f3f2140a1b6cd772050bd22cd966d919a03dd9023fa0d51e71629a5

  • SHA512

    3e0839d7c273da6283689769cab4ac1e0def92fbfbbc428dddbdc6cb7615c4232e9b59fe5e22a8d501cd66db9cc1ff8bbad55a5d46e76f8aabe203b16ed1bd75

  • SSDEEP

    6144:mzFu/4SvNGh4VhmkTNPQTqsTT0Tebd1T80B1+:H/4SVGh4nRITigNB1+

Malware Config

Signatures

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7bbc60071623219f622b4e17e1f9cdc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f7bbc60071623219f622b4e17e1f9cdc_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Users\Admin\AppData\Local\Temp\f7bbc60071623219f622b4e17e1f9cdc_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f7bbc60071623219f622b4e17e1f9cdc_JaffaCakes118.exe
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:1948
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show profile
            4⤵
              PID:3780
            • C:\Windows\SysWOW64\findstr.exe
              findstr All
              4⤵
                PID:4884
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1444
              3⤵
              • Program crash
              PID:1752
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4660
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                4⤵
                  PID:4020
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show networks mode=bssid
                  4⤵
                    PID:744
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3588 -ip 3588
              1⤵
                PID:2388

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Collection

              Data from Local System

              1
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\432d6a01c19570cbe26fd20901a58a63\Admin@NCRNVAGW_en-US\Browsers\Firefox\Bookmarks.txt
                Filesize

                105B

                MD5

                2e9d094dda5cdc3ce6519f75943a4ff4

                SHA1

                5d989b4ac8b699781681fe75ed9ef98191a5096c

                SHA256

                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                SHA512

                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f7bbc60071623219f622b4e17e1f9cdc_JaffaCakes118.exe.log
                Filesize

                605B

                MD5

                3654bd2c6957761095206ffdf92b0cb9

                SHA1

                6f10f7b5867877de7629afcff644c265e79b4ad3

                SHA256

                c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4

                SHA512

                e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79

              • memory/2920-4-0x0000000004A60000-0x0000000004A7E000-memory.dmp
                Filesize

                120KB

              • memory/2920-1-0x0000000000110000-0x0000000000144000-memory.dmp
                Filesize

                208KB

              • memory/2920-0-0x0000000074660000-0x0000000074E10000-memory.dmp
                Filesize

                7.7MB

              • memory/2920-5-0x0000000004A80000-0x0000000004A94000-memory.dmp
                Filesize

                80KB

              • memory/2920-3-0x0000000004AC0000-0x0000000004B36000-memory.dmp
                Filesize

                472KB

              • memory/2920-2-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
                Filesize

                64KB

              • memory/2920-9-0x0000000074660000-0x0000000074E10000-memory.dmp
                Filesize

                7.7MB

              • memory/3588-6-0x0000000000400000-0x0000000000428000-memory.dmp
                Filesize

                160KB

              • memory/3588-11-0x00000000053F0000-0x0000000005456000-memory.dmp
                Filesize

                408KB

              • memory/3588-12-0x00000000056F0000-0x0000000005700000-memory.dmp
                Filesize

                64KB

              • memory/3588-10-0x0000000074660000-0x0000000074E10000-memory.dmp
                Filesize

                7.7MB

              • memory/3588-71-0x00000000064A0000-0x0000000006532000-memory.dmp
                Filesize

                584KB

              • memory/3588-73-0x0000000006EE0000-0x0000000007484000-memory.dmp
                Filesize

                5.6MB

              • memory/3588-87-0x0000000074660000-0x0000000074E10000-memory.dmp
                Filesize

                7.7MB