Overview

overview

7

Static

static

3

863be7c278...18.exe

windows7-x64

7

863be7c278...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 06:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    863be7c278b5060dffd10a22ba1a8212_JaffaCakes118.exe
  • Size 717KB
  • Sample240531-hhgnbsbb63
  • SHA256 121c8691c122114f0da4c92ed57e1d651022416e1619db40c909986a57d1d291
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\863be7c278b5060dffd10a22ba1a8212_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\863be7c278b5060dffd10a22ba1a8212_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Users\Admin\AppData\Local\Temp\00294823\XV.exe
      "C:\Users\Admin\AppData\Local\Temp/00294823/XV.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      • System policy modification
      PID:4480

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        XV.dat
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\XV.dat
        • Size 5KB
        • SHA256 9415c59cbc920d38ca36b9f0dd0f22a2d61302697e693bc654c13f4ab7019714
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        XV.exe
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\XV.exe
        • Size 334KB
        • SHA256 f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3y.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\hhlhgddhkehlkpnhkpnlaagbgjgkcnmo\3y.js
        • Size 5KB
        • SHA256 d5f57684d868a1a60b83166f1e2f222ad76fde94212a6f0bbb0eecd0f7b7d594
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        background.html
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\hhlhgddhkehlkpnhkpnlaagbgjgkcnmo\background.html
        • Size 139B
        • SHA256 df7f7c703dac0162025c854cc5119335e271738e953abd9a2bd2e3fc801802dc
        • MD5 SHA1 SHA512
        Submit Download

        content.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\hhlhgddhkehlkpnhkpnlaagbgjgkcnmo\content.js
        • Size 197B
        • SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
        • MD5 SHA1 SHA512
        Submit Download

        lsdb.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\hhlhgddhkehlkpnhkpnlaagbgjgkcnmo\lsdb.js
        • Size 559B
        • SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
        • MD5 SHA1 SHA512
        Submit Download

        manifest.json
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\hhlhgddhkehlkpnhkpnlaagbgjgkcnmo\manifest.json
        • Size 510B
        • SHA256 8c76632562d1fb51694eda20927e6ca5796ad46c8cf100404a51e3b434054fd8
        • MD5 SHA1 SHA512
        Submit Download

        sqlite.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\hhlhgddhkehlkpnhkpnlaagbgjgkcnmo\sqlite.js
        • Size 1KB
        • SHA256 899d446ea4315d2c345478c936445e6578bc3ea8719dae85b00a7ec7559a55d3
        • MD5 SHA1 SHA512
        Submit Download

        bootstrap.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js
        • Size 2KB
        • SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
        • MD5 SHA1 SHA512
        Submit Download

        chrome.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest
        • Size 96B
        • SHA256 289e55f29bbe416744f895511ac8fd00eead8e5b1611115e39308a2bba0aa7bb
        • MD5 SHA1 SHA512
        Submit Download

        bg.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js
        • Size 9KB
        • SHA256 0b51defec11f2085b43853fc0080e53f160c25bafe928f899d80a2747622ff2b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        install.rdf
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf
        • Size 617B
        • SHA256 9cf56f304f0c4f4fe517aff22caf68cdd7364baf55075f95971f924671b59f55
        • MD5 SHA1 SHA512
        Submit Download

        m.dll
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\m.dll
        • Size 222KB
        • SHA256 a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        m.tlb
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\m.tlb
        • Size 2KB
        • SHA256 c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941
        • MD5 SHA1 SHA512
        Submit Download