Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 18:50
Static task
static1
Behavioral task
behavioral1
Sample
b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
b4a9e6146e5ee73e27cc222d46558fe7
-
SHA1
81b6e45356e51e1de427c394d959830f054617e0
-
SHA256
a689f6a717bd808823b66092ed1d88c404f6d214fb1c67cc891f958d426474b5
-
SHA512
bf44ad688666733957bc4e4bf1061c00dc9a4e831c4712284732ab65507e8e1c87f3bbe0bb2691cc7901332f084bf9230d7a151d96affde5a37054966e9da599
-
SSDEEP
24576:NOfHYrVwwdGkYAsvaGBQT2yaJe3LmGJqS5FUY5elxRbUoOBjvRtkTMfsOVPCw0x:xxZ3UUNJqQPCjbUfkTMfsOVPCw0x
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exepid process 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe 332 b4a9e6146e5ee73e27cc222d46558fe7_JaffaCakes118.exe