Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 22:37

General

  • Target

    00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe

  • Size

    284KB

  • MD5

    00ea206f316981790d5eedc6aaf23d00

  • SHA1

    b9c553609b00b3b626d55505d3a0d112672d43b6

  • SHA256

    77eb02d972ac37ee02210a3ba0ae73a0f2e904e6c40aa46507354aa6e9ed46ed

  • SHA512

    08c20d978527f4e943616e83282f01b295c300134a737c6022c2ccc967fea227c820eded3780213fe6580cb3d93976ad4d493dbb1ab420b2b1b68c27f4561a2e

  • SSDEEP

    6144:RT74IZNWcMeBNTlJV/oHWFQnx85FfUUE8rMrsqpyaQ74dtI:jLBbvoHVxMJUUE8rMrsqQrMdm

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\00ea206f316981790d5eedc6aaf23d00_JaffaCakes118.exe
        /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
        3⤵
          PID:2996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2364-2-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2364-17-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/2996-7-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2996-9-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2996-10-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2996-12-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2996-11-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2996-16-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB