caeea6c5ea51cb89b6171ff1980f5a21b973c1454d819ea59168f782e3e8195f

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe
Size 369KB
Sample240613-l2766stfnd
SHA256 caeea6c5ea51cb89b6171ff1980f5a21b973c1454d819ea59168f782e3e8195f
MD5 a4fbb9f7c8aad9fcbcf7e1b9c99efc5c
SHA1 697578ede6ec4e510212f415305caa0be465a8d6
SHA512 1d7c25abae53b708c28a37feabd5f719cb482c02e8c4306b75caea2b310466e3f7908f7e62726fd4db2df882b08a6e5bf6b6a5cfffd2048886ef05e90d15f99f
SSDEEP 6144:05wWwGpW3/5oWgBX7kxoqU9g2+jPJxXbcMelSEnIubnC5OMIkfDaq3/h6a:05wWT7pBT5u2+1NAplLBbnOOMIVq3wa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4888	n1s.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4888	1996	a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe	82
PID 1996 wrote to memory of 4888	1996	a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe	82
PID 1996 wrote to memory of 4888	1996	a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\n1s.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s.exe" "C:\Users\Admin\AppData\Local\Temp\a4fbb9f7c8aad9fcbcf7e1b9c99efc5c_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

n1s.exe

Path C:\Users\Admin\AppData\Local\Temp\n1s.exe
Size 995KB
SHA256 29c755da051012b3c24210e0b7b5d21c5a6e3a2b5706ef677dd522adb9ffdc53
MD5 49f2883c7847458ff575443004aa2630
SHA1 60bb85607ffb3b8f80ab2848807e4556fa95b7ef
SHA512 8f2a1b145d4d9b9f41fbf96e4bfb022c4e15dfd299653a3f7d2dd5f02d198101bb8c9755d9687e2f0eccaad6bc6ea5cd04fd9a4c17c56f8cf041167d418619b9
SSDEEP 12288:ngPd9L5kmkqwueQDyR1hU/41yWgXtKt7ziRy:gPblaqw3iRWZt7Wo
MD5 SHA1 SHA512 SSDEEP

Submit Download