Overview

overview

7

Static

static

3

04fe616619...18.exe

windows7-x64

7

04fe616619...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 10:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04fe616619eb2b1a612fd1dd130f89bd_JaffaCakes118.exe

  • Size

    20.4MB

  • MD5

    04fe616619eb2b1a612fd1dd130f89bd

  • SHA1

    99938d2adfcea7ce4a5d52061409a2462cebe835

  • SHA256

    1a7f568d562c3f85c4f79b34a41eef8c4aab28c9d7677ef7b6ead11328f2b58a

  • SHA512

    b39aec9d50fe175e43f1d9562c2fdfea734be0f921b4b5f29a2502a937142ea1c04fb89a3fc145f937e20a81cd16aaede6774259c1938defaa52869d9ff748d0

  • SSDEEP

    49152:XYgph7GBfWgBYcMbHP/4MnYYJ2ZhqSGLHkJEMwDkYOMwwnMb4PmyVOz/4MnYYJ2G:XX77GBfWgB5rIDQdYOXwnS4rVOsIDQ2

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04fe616619eb2b1a612fd1dd130f89bd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04fe616619eb2b1a612fd1dd130f89bd_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3488 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:5024

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.exe
    Filesize

    20.9MB

    MD5

    d04d0b69fd7110a9e86f246271ad00b4

    SHA1

    e3346e535715a3c9c76178d13bddd70849f87bae

    SHA256

    196adba8431f7b53aaec1007c95494401049cf8725bb3468bc43c79a3d6119d1

    SHA512

    ac5caadb7fe835e7e5bd23ecb9e0d866a62f9b95dafae29af515a53579d065292f0dc2d0d5ceab887202c215d93014884f201bc1b12497c20386f5afd1a183b7

    Download Submit