Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
08-05-2024 15:00
General
-
Target
2561fe0b8dc127e519060d27c8d1bab9_JaffaCakes118.exe
-
Size
12.2MB
-
MD5
2561fe0b8dc127e519060d27c8d1bab9
-
SHA1
e9a7274a80bf54500548db2fd5101fe7e734df71
-
SHA256
2d5c9e027ee3da44d9b6d7f2207d516c59e914ea393bdbb7eb75b3d2faad37e7
-
SHA512
a59093f74cc5eef4835f8ca2a852622f7b35296f3997c68a4ff17b25fd0afb0c395eed9afc0755d13947ec2c22c95db265529b30c334d3137037d5bd7ddd0695
-
SSDEEP
196608:UwoanC5eKj8FATCoLl/FzPGCv36B81IJyH4RALa9rgZZoTDBjerFO2x9hQeyu:sanC5AMt9GM3F1uyeAGpgZZ2CpTDhQg
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2561fe0b8dc127e519060d27c8d1bab9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2561fe0b8dc127e519060d27c8d1bab9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9MP05.tmp\2561fe0b8dc127e519060d27c8d1bab9_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-9MP05.tmp\2561fe0b8dc127e519060d27c8d1bab9_JaffaCakes118.tmp" /SL5="$400F4,12366293,146944,C:\Users\Admin\AppData\Local\Temp\2561fe0b8dc127e519060d27c8d1bab9_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AS7BC.tmp\reader.exe"C:\Users\Admin\AppData\Local\Temp\is-AS7BC.tmp\reader.exe" "C:\Users\Admin\AppData\Local\Temp\2561fe0b8dc127e519060d27c8d1bab9_JaffaCakes118.exe" "(x32)HKEY_LOCAL_MACHINE\Software\\TweakBit\\Driver Updater\\2.x\\Settings"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
227KB
MD55401e0dad5d356b1fed2415ee22a051f
SHA10eabc3d33501e285f99dcce2ae80225ca5e0632d
SHA256af0cca4584b240ad3b04c20bc4fd696e5c4c2f5d7bfc8df183804da4e0b6fb2c
SHA512a5a8951eb27932da5334e4249d412bcb74800e3acaeb10cb344f5157254dc65a66553009482a6252ecbf032cfcbd6a622c9684e2bd11c60d58a20c8c2351de00
-
Filesize
502KB
MD5458d626c371b0c9a3df77340fec128dc
SHA1b481f7fdf4ea7a0fafdca1dd622bd965fc1d7c87
SHA256731d5634c4e31f124e40e8f4d65636a0351d386729571624838fa91d9c061ff1
SHA51250fd7a396b124abaa3921c9ce8177cc2e16eed3ad35edf0f0efd45493ebd3d8869fee7a63a7487dc5f98118e981852746c2c8b03ae2c5b8d5f163dbdef758c72
-
Filesize
1.2MB
MD5be52f3f8e2cfd801e4e8bdbd0bffa065
SHA17bf6483be554986b92581d4e693bbad22318c39f
SHA256dfe9dfe0cc98c797e0340bee073c3d785ddd0ad78ed6fc24809cfa339c156d1b
SHA5122f3d313dd6f9d8f8bf526b54f3031f27609f4f8d548d7ea6e9950d9bc2f76c6dc53af75986f0db0123b936ccb874fda7a36b417d4ad60c4f6de587573ca422e0
-
Filesize
1.8MB
MD5e000d3f93a6b1db3e056417152434313
SHA1773a16ac587ed2245be4a61eab3608a59391219e
SHA256c22fad88d23c08db4ed7008a074205b88e624c6d02bbb96ac87a28ea53f3741e
SHA512def584d6d2bc7d3f9ec48f07d8f31046019b0998d5a390a82ff85aa5fb1daa1f672c8259ea4c33981c09e8bdb1883d34c5ea8aaf9f7bf77b3a6b05cb274e02f5
-
Filesize
6.3MB
MD55fc46e0319e3cbed209551ecfaa9e9a6
SHA168d2f9d1b768fbc629df9a3f8d7485455143f4d1
SHA256f4152ca2a44fab5a1f23967d7da143a2ecf5d86f5a0502afed452adb38a53c9b
SHA512964cb9d43a7ef854f9a241acc8c5439465e81179efbde20b2c214e845ccb4203ae2117c9d5cf57ab780f9ea637185a5574bd7ad4c4e53f464c0de3483e3b31a4
-
Filesize
1.5MB
MD514ddfd9b9edae7146a2d82f961cc6790
SHA1e4c011e6334436f541c7d55f4a311259400ffef7
SHA2566039cedce7d05f2559b27e6d8d68c97a8485a59b17822e4fc0ffda932a946fc0
SHA5124218a6ac38c9f9a9c38e8ffa0a9cecd73cb8212dcb33fdf23c1c7e7ba86adba4c69eede83798878c9e2013f2a7e2fb6151fa89c4be5ad4d94a467457c1de2ed4
-
Filesize
89KB
MD560379761a033e0630788ea4d47138185
SHA1fba480d77b30c7293bf42da38567c03a561d76ce
SHA256b3900fc358adbb46ea4aef74b5d4dd46cee4d82927fea8607019ac375f0e8d20
SHA512a110b48209903dbc3197d1bd43d721d9fc0e6ab515c9b3f1f40e85b0fd55483d9de7ddaf4254c207f1879a53a9427506c5a25b5c6109edf15ebeebfb0dd839ab
-
Filesize
294KB
MD5765f93cba8e5831e2ee24f158d65763b
SHA14cfdafebb8c027b51a896a3eb3aecbc4d008487b
SHA2567e9d4f8be7971cd9716884617e4dea01ecbdcd9bfcdb960dd623732d02168dd6
SHA512309e672d5296a51a0b7763dedcec16e2b4feebc051351949b98f2e7386b82bcca6992f7449613a9f0a7dd3de26c03857f640fc1b5551b3d0cc111d623e03d31b
-
Filesize
4.6MB
MD5993646ff88f0668280c6000430969168
SHA1b5a6cfb816fd3235b2055e79d15c669788f1427c
SHA256a812c257d1a022d2838c2ed550baa9b40c4293f59e8ef302bfb12864d596b0c2
SHA512979fb298653250923cbbb294aa532e26f28986be090364c3e456cf9c0edce272c8c93b6db0c3b6740a0000fcbc7643ee36b944fb8f2120de861912f6ddefa5b5
-
Filesize
116KB
MD5b570b78534eb869ccbb30669203dd66b
SHA115103864a1d8ae384098433a779d5297f630cd53
SHA256f75901e74681d0f849367e9cbd852e9b3f7b50f6e6464b957003f3e5bb3f22b0
SHA512443f73235989700b8040486e3cf3031935ccbea143e486b83b9b9adcc5b2b29a774e2030a760737d0a195cfed1c5aa3fe1211b2df16f987fd95f9c6bd290cc15
-
Filesize
190KB
MD57be5043e4d48c69944c2d91a885a8a8b
SHA17367b8acae6927e93a550ede899a670165c04e0f
SHA256fdf4e106f376a9a7ad83cc7cb0555a8be85aea4b83548c008837a8610662eccb
SHA5126f4eee91c31c631ce3ce712efa7b2cf3740d67ebb5330dad3db03b64f07714b89525212850ee5f712e13a2accc8abee02a8ae48500fe1001d079039c2750bc1e
-
Filesize
1.5MB
MD568e66515662fa3b706edcd0e1c5ac701
SHA1cbc9bec77afd5224f1fbbab5b5b994746ecb8145
SHA25607baaa9e058349c243caff2d04786bca9ae223b480f7e050f04c649ebe44c3e2
SHA512a1bfcd28a42ba2ff9b9d67d4ae1eaf121273396e7c570c6dab0b63fee53d886f80c1f8dba903073f2aabfc6fea27bb6c2b8b54cac8522bd918b16b5f8503cb96
-
Filesize
10.1MB
MD5ae3b3b80021495c01da4cd6f22682f77
SHA13e2be3a54756752b6c40baefd0a6f1f0a51d8190
SHA256eb36a1b1998f27cb1e64c02c49e88b621a3f0b44484c09fa7e84eb5588cd38c9
SHA512f2ffb60c059dd16ffa82ba58cbff901a4670560bcb562b0e95a6dcb6f82fd326c63742ae98c7b47f6f10adaa8532e9157c23da9368544d05b7e99b9ed56aed97
-
Filesize
836KB
MD54caf2a8ed45c12150c1ace254bff608f
SHA1b9a43065bf45c2fd53617b626a9052876907f73d
SHA2560e66c25c60d282f346cf538fb2ee69bb75e5164090419e349af7aead1d4c35db
SHA5123ea2d1431be81dc8c50e8b31dcdf9e0d89637e92b403cc04137f6cb30559afbd842cc4046f5aa35d33294c175b8d2a1c33c5898085cea65e2c2860fd09d04a7c
-
Filesize
3.9MB
MD56a897f43aedcc8760aaba6e93714f1e2
SHA162f037e9ba0291b563f90cd1eadd6ce174847e81
SHA25694dba2ae097bf73edc06cb3084805b6f83e9348d1a1e9bce8ab17f14f976279d
SHA512f0121bf83236b7de1cfd7a99031e74b1dea2cbd2eb76d86fbcb02251021c989548615da411abba36796ee36d3b254eaa65249b3f77efdb48a16b224a63f03027
-
Filesize
357KB
MD5ce19a7d9ef38d037e4084df12ac82062
SHA1dce889e114508055b34cda588c2199f6da23eb14
SHA2564593c64c8a4be0ce80107c21ce5d637ace8fe646b2cfc347940c760adee162dc
SHA5122c31714e3e0514ad445a13289c5bc928e12ea3fc8f74d26ffcfb26cc17bf45575e5cc74ba21f3bf4cac52cceabc72cd004aaf46ac9d9f1dd984453d1aa134cdd
-
Filesize
68KB
-
Filesize
184KB
-
Filesize
10.1MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
312KB
-
Filesize
212KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
6.3MB
-
Filesize
360KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
136KB
-
Filesize
1.2MB
-
Filesize
1.2MB