Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 00:46

General

  • Target

    ac4a08f756216de41b0364bf62b44f82_JaffaCakes118.exe

  • Size

    874KB

  • MD5

    ac4a08f756216de41b0364bf62b44f82

  • SHA1

    aee730297dd1a1700bbf5ee4b10df790e267b2a3

  • SHA256

    53f4320945ce77a43d8cec88ee3ae817573bac4e33189d47043238b23aa77fbf

  • SHA512

    1973ac1707d93110a21427a46e2c8c579f5c8fa9c509a401a2f6f676f640f1b49eaa8ac0e14bca5cb8e6981064ac6931fe04b0e78799e58720c6b1e619f689f1

  • SSDEEP

    12288:1LJmPlzSnSXGbFFYd7PfxmbKHBkTTkW5Bdhn4ltH80xjxkxQuZwEjFTa1gG1+QjC:mPRwUdF0akfkYh4lW0xjWJhotjyN0

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac4a08f756216de41b0364bf62b44f82_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ac4a08f756216de41b0364bf62b44f82_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2164-1-0x00000000003D0000-0x00000000003E0000-memory.dmp
    Filesize

    64KB

  • memory/2164-0-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-2-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-5-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-4-0x00000000009EB000-0x00000000009EC000-memory.dmp
    Filesize

    4KB

  • memory/2164-6-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-7-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-8-0x00000000003D0000-0x00000000003E0000-memory.dmp
    Filesize

    64KB

  • memory/2164-9-0x00000000009EB000-0x00000000009EC000-memory.dmp
    Filesize

    4KB

  • memory/2164-10-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-11-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-13-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-14-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-15-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-16-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-18-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-19-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-20-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-21-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-22-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-23-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB

  • memory/2164-24-0x0000000000400000-0x0000000000A20000-memory.dmp
    Filesize

    6.1MB