Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 02:56 UTC

General

  • Target

    b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    b170d408ce29781ef0ea9c01d224bb20

  • SHA1

    b07866e4c94e97487de4d3a7fea83aec4fd020c7

  • SHA256

    5fd49a865edd340425c96f3ba5630622d978f2de3c270417b745a61d817b6c7f

  • SHA512

    9732131abe4c99c80c43569b76d2b47e5e950058b8afff9c74e1ef3bfeb24360733ea6f530be287a0c3a04767df87d503492abdead456fd038217c31bc46ef19

  • SSDEEP

    24576:rMHnA4I3OJcm9CV/EIEEfdnGzrzTZ+CsZ6Tniyoh:rMI3MJkEAdGzzZ9Eiiyoh

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe"
      2⤵
        PID:2488
      • C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe"
        2⤵
          PID:2852
        • C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe"
          2⤵
          • Adds Run key to start application
          PID:1448

      Network

        No results found
      • 176.38.110.20:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 213.111.198.20:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 92.87.210.24:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 88.223.67.27:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 122.254.39.29:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 75.107.254.63:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 77.122.32.69:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 197.6.7.72:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 176.118.51.72:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 141.134.219.74:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 95.58.101.96:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 211.104.220.97:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 200.63.39.98:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 213.200.46.98:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 95.26.230.99:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 190.163.231.50:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 5.83.20.52:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 5.178.141.52:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 95.47.23.59:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 178.168.23.60:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 65.188.218.173:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 89.37.119.174:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 77.41.6.179:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 50.169.215.184:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 49.205.47.195:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 101.55.162.5:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 86.38.189.5:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 74.67.10.9:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 46.211.72.9:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 176.116.62.11:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 77.71.177.16:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 77.87.41.17:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 5.105.39.19:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 46.55.67.19:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 176.37.119.19:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        152 B
        3
      • 62.72.177.197:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        52 B
        1
      • 78.139.188.197:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        52 B
        1
      • 194.146.199.200:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        52 B
        1
      • 95.69.200.203:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        52 B
        1
      • 176.111.178.205:80
        b170d408ce29781ef0ea9c01d224bb20_JaffaCakes118.exe
        52 B
        1
      No results found

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1448-15-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-1-0x00000000001B0000-0x00000000002AA000-memory.dmp

        Filesize

        1000KB

      • memory/1448-5-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-3-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-7-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-13-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-11-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/1448-14-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-8-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-19-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-17-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-25-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-16-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-20-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-21-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-23-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-22-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/1448-24-0x0000000000400000-0x0000000000645000-memory.dmp

        Filesize

        2.3MB

      • memory/2988-0-0x00000000003F0000-0x00000000003F4000-memory.dmp

        Filesize

        16KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.