Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 14:31
Static task
static1
Behavioral task
behavioral1
Sample
181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe
-
Size
196KB
-
MD5
181d1c0f87b5054ec4b76881abd8bee6
-
SHA1
fee7563206b1649ee97e97b2be5151eeed3e5b1d
-
SHA256
95243c2b1612cc480064343f0f6445da2ec3d118f00e2115b7fd1ea68e867bec
-
SHA512
6058e85b369cc3a3669e0c96699fbb1f55b7bc4f274e3c564fbd38937d1d3b206d8771f9bd813131aaa883371d03b437566c4d7a8688dc39649859c82088837b
-
SSDEEP
3072:AXZxpP/LI6iwRtjG4DrcGqGI9fP7AhdLEsUXbPwUO784beW3VzrAHHZD5YgwJpeL:AXNqH4DmX9fP7AHEBb+bvxrOHqgL
Malware Config
Signatures
-
Taurus Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2956-3-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2956-2-0x0000000000220000-0x0000000000255000-memory.dmp family_taurus_stealer behavioral1/memory/2956-5-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2956-4-0x0000000000400000-0x0000000000F8E000-memory.dmp family_taurus_stealer -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3020 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2548 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.execmd.exedescription pid process target process PID 2956 wrote to memory of 3020 2956 181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe cmd.exe PID 2956 wrote to memory of 3020 2956 181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe cmd.exe PID 2956 wrote to memory of 3020 2956 181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe cmd.exe PID 2956 wrote to memory of 3020 2956 181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe cmd.exe PID 3020 wrote to memory of 2548 3020 cmd.exe timeout.exe PID 3020 wrote to memory of 2548 3020 cmd.exe timeout.exe PID 3020 wrote to memory of 2548 3020 cmd.exe timeout.exe PID 3020 wrote to memory of 2548 3020 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\181d1c0f87b5054ec4b76881abd8bee6_JaffaCakes118.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
PID:2548
-
-