Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
a358ee59fc0931f1ae2eae134e7b2959
-
SHA1
ea2eb3581eba66e0895adc7f40bd7553ca715b56
-
SHA256
b32eabfffa4d397b1c9b76e9a5d9f84221a24723a94efbd994d952fd86b4b3c4
-
SHA512
7135e9d9b5eadc06e75280412e830aad9d8ccf73a37fa55d9124724b2e9d1f1ac268b203ec121c7360ba948465a62337f2ab8628f804698e4cbef19fa43269d5
-
SSDEEP
24576:ff9XGBmFTuP87DS2riSCzG7IPRosJWlvjc2Ux7aZDp5DtCL:nwoJDS2OSB7IPmdFUwbDtCL
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1688-1-0x0000000000400000-0x0000000001BD5000-memory.dmp upx behavioral1/memory/1688-3-0x0000000000400000-0x0000000001BD5000-memory.dmp upx behavioral1/memory/1688-13-0x0000000000400000-0x0000000001BD5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exe" a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exepid process 1688 a358ee59fc0931f1ae2eae134e7b2959_JaffaCakes118.exe