Analysis
-
max time kernel
91s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24-05-2024 18:20
General
-
Target
6f6c364823a92d70e6e4e7596c022363_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
6f6c364823a92d70e6e4e7596c022363
-
SHA1
a774879a1ae0b79071098fbe99cbc05930127223
-
SHA256
6bae1786a63c3d701261c1e6240aa51fa5df97a1deb1feafcd1682a6c732cfe4
-
SHA512
6e856fc0d31935c5e5de80cffa1002314ded478a544d50d92cf758cfcaeac8db9ec884ab1e5235fb55c779af409dee29512036fbe8314fd7a611b796435cc9e7
-
SSDEEP
49152:Ak/TG0iRbBgslHqAZbQHNq04A6x5qyzxprsQWIVQF:p/6LBgsLbQHNq04h
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f6c364823a92d70e6e4e7596c022363_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f6c364823a92d70e6e4e7596c022363_JaffaCakes118.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\NXHw962A155E26\26962A155ENXHw\Files\OpenReceive.txtFilesize
191KB
MD518f51801211b50c0803f7c97f78344ca
SHA14532a050fed429a24d576fcec977c2a1e2fe9618
SHA25641227b85e3f8e222905ae475c734c19348966832f1e4faa37cc48775c855c9ec
SHA512c2fa3514dc2b7e37eb14eb55464f9471bd347cb9a31cea50f0a72d7886fdcef290ec0117e2e77cf4a041c804f146d00fa9b1d62e089b845d2c7100a0f2fc09e7
-
memory/1704-1-0x00000000003F0000-0x00000000006CA000-memory.dmpFilesize
2.9MB
-
memory/1704-0-0x00007FFB795C3000-0x00007FFB795C5000-memory.dmpFilesize
8KB
-
memory/1704-2-0x0000000000D60000-0x0000000000D66000-memory.dmpFilesize
24KB
-
memory/1704-3-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmpFilesize
10.8MB
-
memory/1704-5-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmpFilesize
10.8MB
-
memory/1704-6-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmpFilesize
10.8MB
-
memory/1704-9-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmpFilesize
10.8MB
-
memory/1704-61-0x000000001CA70000-0x000000001CA92000-memory.dmpFilesize
136KB
-
memory/1704-62-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmpFilesize
10.8MB