Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 00:39

General

  • Target

    9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe

  • Size

    3.1MB

  • MD5

    9328cbaf393bd868720794b6137db9a8

  • SHA1

    546f241a90b63853b18a5c0cbcafdb8828b2539f

  • SHA256

    66685c4afa8d159b3f612be71271e25e07111a1e80b81831bd1ee3d03d3a9f11

  • SHA512

    e9b77c5f8e480d6f1cb237cdabb9a582c6a445eebe50ebef68ea587a51f5b9b9f7aa71fd921e38425cf206d4253d8c8e601b89bbcde110533c8c7eb3a8dc8b00

  • SSDEEP

    49152:b3NpfZfpWZNU5XstFviQJXZNhAj/WjntIVKLI7kxHKMPN//4JXTgRItETQSQ:b3ffZxWCSxHmJXT7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe" --crash-reporter-parent-id=2288
      2⤵
      • Loads dropped DLL
      PID:2300
    • C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=56.0.3051.31 --initial-client-data=0x10c,0x110,0x114,0x108,0x118,0x752ce360,0x752ce370,0x752ce37c
      2⤵
      • Loads dropped DLL
      PID:1328
    • C:\Users\Admin\AppData\Local\Temp\Opera Installer\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\Opera Installer\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    74e9b039dafdce0cf8e45f0174a89a34

    SHA1

    9f3bd0d54e277e55242dae952effde8a6af8108a

    SHA256

    942bacc22f48044d0fa989353860534a1600390069d0112f5741492878173e7f

    SHA512

    95cfb76bd43a9057e1ff74b6ccb36bf5d3ee911900f9052cfa1e150454a375b6ea09a845066bc99d354bbe107aeb73feafdf8c4d138b8685336dbf6a042753f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6f691e24b93ac439f32b7a34c21524be

    SHA1

    c39d75183dfc394e993fb99b64a2a4cbe44c8963

    SHA256

    9bd852d3ce25effe995d1bc9ccadb55d626b13cf5da231f99f5afdcc0d8c4dae

    SHA512

    a8699418b8f58db711332fdeb3259db5bfb364a487b86eaaa36c273e76bb9593630f098e5b8ad80acd05ff8ea04cee09193b8981bfb9b76ee50da087bde00f85

  • C:\Users\Admin\AppData\Local\Temp\Cab1170.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Cab11EF.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1204.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    e3bafceb63c9f97dcbdaad678c051ba2

    SHA1

    8bf73db1f4a7d2b9eb484e2b66715a4b2c85f1dc

    SHA256

    828d9556bc9bc041f4190e9fc92aaa7dbe89661458e0a0f279724327b76dc5ba

    SHA512

    07a2a4dabdd590489805188a55107a6886f4710f1d8910358d27cb0e3f006a9cabfa0ab0574890832702a30f3ec84ded9b8033b093aaab391c6cc4b1a330d605

  • \Users\Admin\AppData\Local\Temp\Opera Installer\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe

    Filesize

    3.1MB

    MD5

    9328cbaf393bd868720794b6137db9a8

    SHA1

    546f241a90b63853b18a5c0cbcafdb8828b2539f

    SHA256

    66685c4afa8d159b3f612be71271e25e07111a1e80b81831bd1ee3d03d3a9f11

    SHA512

    e9b77c5f8e480d6f1cb237cdabb9a582c6a445eebe50ebef68ea587a51f5b9b9f7aa71fd921e38425cf206d4253d8c8e601b89bbcde110533c8c7eb3a8dc8b00

  • \Users\Admin\AppData\Local\Temp\Opera_installer_2406040039173662288.dll

    Filesize

    2.3MB

    MD5

    d032b5dfbc2948f9501b730f64cafe12

    SHA1

    8e0a3e18b542e7cec52e219ab1443e64f56d7bcc

    SHA256

    13044ba760abf383e1197bc046a9fe7f84d36bb9c6dcdd503fcc8e0acfa427ce

    SHA512

    2c27fb659fa947894f9069cff15869a1cf323d663bf2fd4626eeb4b25d64ee24c8427e232f63c021c0d4a9511b82c5627fbfab0fd66b40eedf51c6b32b503482