Overview

overview

7

Static

static

3

01255248cf...18.exe

windows7-x64

7

01255248cf...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 03:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    01255248cf04b0d2f08c8004910fbe79_JaffaCakes118.exe
  • Size 315KB
  • Sample240622-eft9vswhmh
  • SHA256 fe54f319f3f1bbddd346add7112ec5fce34c50adf86bf8f24135b7af30847553
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\01255248cf04b0d2f08c8004910fbe79_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\01255248cf04b0d2f08c8004910fbe79_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2680
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1120

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          uninstall.exe
          • Path C:\ProgramData\ADDICT-THING\uninstall.exe
          • Size 46KB
          • SHA256 03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          chrome.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\chrome.manifest
          • Size 114B
          • SHA256 44472176b02fa1194e5be2528ac1f8a5e2ef4b6f3529375ba51382f5fb36af29
          • MD5 SHA1 SHA512
          Submit Download

          indexeddb.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\content\indexeddb.js
          • Size 1KB
          • SHA256 90f556b411ce4487853ce28a86e6e6c560e7249844c175882dbed86c52241222
          • MD5 SHA1 SHA512
          Submit Download

          jquery.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\content\jquery.js
          • Size 91KB
          • SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jsext.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\content\jsext.js
          • Size 6KB
          • SHA256 fd0ffe28699074369165611e46ed3dc4ddb3d573666e9ee51a143d6162b66eb4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lsdb.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\content\lsdb.js
          • Size 1KB
          • SHA256 3f0f69db7d081ea6ff0fdf3e1b2ed1106e4298da1112e297f7502fd362953099
          • MD5 SHA1 SHA512
          Submit Download

          prfdb.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\content\prfdb.js
          • Size 1KB
          • SHA256 46a927bda123791b7343190d524bc8151aaff6465860634d0fb8762a34d74e08
          • MD5 SHA1 SHA512
          Submit Download

          sqlite.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\content\sqlite.js
          • Size 1KB
          • SHA256 26c0ba17bab190349f51a98e7102e1cd4f21cfc9e42a82d6c964356422f1cfdc
          • MD5 SHA1 SHA512
          Submit Download

          wx.xul
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\content\wx.xul
          • Size 228B
          • SHA256 6fae6a30888459ace1e3531c08450a176e40ab020cee75bb26f682c6a20aa1b9
          • MD5 SHA1 SHA512
          Submit Download

          install.rdf
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\[email protected]\install.rdf
          • Size 677B
          • SHA256 0078e0202a8752828bb9f60fc75478d245efdaa70ed03a162e45b407caf13c94
          • MD5 SHA1 SHA512
          Submit Download

          background.html
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\background.html
          • Size 5KB
          • SHA256 df830a4bb70ea52e6ebecc489897ea99287ebae4ab281b2c9ee6374580a94e7c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bhoclass.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\bhoclass.dll
          • Size 139KB
          • SHA256 2b4d643a8a14f060bf3885f872b36e5e1fe1e777ad94783ba9593487c8e1f196
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          content.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\content.js
          • Size 387B
          • SHA256 20c580d3f99fe0f9db9518c2d6d3f7600e8ae15328d656914324a9a110b56642
          • MD5 SHA1 SHA512
          Submit Download

          eoopffnlgmjhikifbioccdjbkdlacpgm.crx
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\eoopffnlgmjhikifbioccdjbkdlacpgm.crx
          • Size 37KB
          • SHA256 5e618cdcc45cf0a4f1c67c51cb337dfdedf672e53f9c6e5c36404fd315049210
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\settings.ini
          • Size 610B
          • SHA256 26e4daafc10af61a5142feb5f4f0bad4cdd625457cc39eb3629d0ef783296f32
          • MD5 SHA1 SHA512
          Submit Download

          setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zSF5.tmp\setup.exe
          • Size 61KB
          • SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download