Overview

overview

7

Static

static

3

01bbf8556e...18.exe

windows7-x64

7

01bbf8556e...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 10:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    01bbf8556e2cf8d450c793874dd28e14_JaffaCakes118.exe
  • Size 252KB
  • Sample240622-mt6ttaydrp
  • SHA256 e31f2d521f8db31593b2e172b8114d652431dbd805c4858be48a2fb1c3eff190
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\01bbf8556e2cf8d450c793874dd28e14_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\01bbf8556e2cf8d450c793874dd28e14_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2520
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1632

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          uninstall.exe
          • Path C:\ProgramData\DownloadnSave\uninstall.exe
          • Size 46KB
          • SHA256 634557ab79a29fe800721bc5f146a9b86799b72eb6755e821492f85ca66818a6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bootstrap.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\[email protected]\bootstrap.js
          • Size 2KB
          • SHA256 bba9d13c3738ea9a3541dc9cd59950f0ebac4e73380a7ef0e9a42228346c3d62
          • MD5 SHA1 SHA512
          Submit Download

          chrome.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\[email protected]\chrome.manifest
          • Size 116B
          • SHA256 4b97b7f0f18e454d26394d548444e2c174978f4f5b723ec7e6b5c54cc192aca4
          • MD5 SHA1 SHA512
          Submit Download

          bg.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\[email protected]\content\bg.js
          • Size 8KB
          • SHA256 3210e648adff8f4c0c76ae3e6fb8568055a02af5269647e82b38e708b653a742
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zy.xul
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\[email protected]\content\zy.xul
          • Size 225B
          • SHA256 53b11ae5334d137b11a3374ec68820e7b6f18f87a09193bf856d6f8837e7dc6a
          • MD5 SHA1 SHA512
          Submit Download

          install.rdf
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\[email protected]\install.rdf
          • Size 720B
          • SHA256 7fe22e7e174061fd413b0b6c0782c95e06bb3c4b70985eb76e5b94a1f1059ee0
          • MD5 SHA1 SHA512
          Submit Download

          background.html
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\background.html
          • Size 4KB
          • SHA256 a44a4e9d060fee58a32b62e7a15844b22b0c37febd2d88957f3c6ca74a99eccf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bhoclass.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\bhoclass.dll
          • Size 139KB
          • SHA256 2b4d643a8a14f060bf3885f872b36e5e1fe1e777ad94783ba9593487c8e1f196
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          content.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\content.js
          • Size 388B
          • SHA256 5ad199429b0530bc4f3ab8bbb326eaf2b6a2652a521e8690df919199ceddede7
          • MD5 SHA1 SHA512
          Submit Download

          hamncannohokcjblaabkkcjoeifkljcp.crx
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\hamncannohokcjblaabkkcjoeifkljcp.crx
          • Size 3KB
          • SHA256 d3eb7dedcf5ae5b66cce4e9f1932c985b451019721a2962274c9a159dafd2d42
          • MD5 SHA1 SHA512
          Submit Download

          settings.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\settings.ini
          • Size 675B
          • SHA256 13197cf89ba7c46e2006ce80b95049a8f7c794f2731de36d1987951e0df35e7a
          • MD5 SHA1 SHA512
          Submit Download

          setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS10F3.tmp\setup.exe
          • Size 61KB
          • SHA256 6b9a2b64b90799f1d50458dc38fb4e9e13a8abb37210c8f5d9eeedae84c6912f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download