Overview

overview

7

Static

static

3

02de9a5da1...18.exe

windows7-x64

7

02de9a5da1...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 16:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    02de9a5da195eb955920bd98197e0205_JaffaCakes118.exe
  • Size 315KB
  • Sample240622-tpzchayarj
  • SHA256 747cffa3e784085ade74703db5bcf524ade534245c91ea23014e4c8a34aef8d7
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\02de9a5da195eb955920bd98197e0205_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\02de9a5da195eb955920bd98197e0205_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:552
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2024

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          uninstall.exe
          • Path C:\ProgramData\Bcool\uninstall.exe
          • Size 46KB
          • SHA256 03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          chrome.manifest
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\chrome.manifest
          • Size 114B
          • SHA256 1abe48c407e3cd4ae56694353a54da0fd1926751b349d2a201cb1fac4df27692
          • MD5 SHA1 SHA512
          Submit Download

          indexeddb.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\content\indexeddb.js
          • Size 1KB
          • SHA256 16d7a043bc9068487522ea5b2559b2bff2397161dd9d5078df2bd2ac12833378
          • MD5 SHA1 SHA512
          Submit Download

          jquery.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\content\jquery.js
          • Size 91KB
          • SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jsext.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\content\jsext.js
          • Size 6KB
          • SHA256 140753deb33c2fec9e375eea1e031f60f27a0e611d4a8b0a6610506b7f74e686
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lsdb.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\content\lsdb.js
          • Size 1KB
          • SHA256 51525778299dc6d6166f65e8c900e7a35d6f5341adb6659c3138630b48d666dd
          • MD5 SHA1 SHA512
          Submit Download

          prfdb.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\content\prfdb.js
          • Size 1KB
          • SHA256 37ded2933eea368f2c680a5e5b4aa63db1b15283d9c532783db76c3f30aef852
          • MD5 SHA1 SHA512
          Submit Download

          sqlite.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\content\sqlite.js
          • Size 1KB
          • SHA256 28047195beab803e4d2d5c2c99fb3bc495d2f600b1212cd0ab6b02c65072cb90
          • MD5 SHA1 SHA512
          Submit Download

          wx.xul
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\content\wx.xul
          • Size 228B
          • SHA256 cf56a389c5ae3fb171f40c3ca15e32596db44d28ba896ea324b0f61a20edb244
          • MD5 SHA1 SHA512
          Submit Download

          install.rdf
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\[email protected]\install.rdf
          • Size 668B
          • SHA256 1ee16a8681c33c3fe383e59ef421983822179b808809e6fda78e4ff32b5ce446
          • MD5 SHA1 SHA512
          Submit Download

          background.html
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\background.html
          • Size 5KB
          • SHA256 0e55db9554f79a75d0804dbaf5736841c3dd12bab448ac840bc11ba60c798f23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bhoclass.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\bhoclass.dll
          • Size 139KB
          • SHA256 2b4d643a8a14f060bf3885f872b36e5e1fe1e777ad94783ba9593487c8e1f196
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          content.js
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\content.js
          • Size 386B
          • SHA256 c82eee1ed3e31122903f43fdc24bdeb10b66cbc88d29508491a09724174a351a
          • MD5 SHA1 SHA512
          Submit Download

          fhnlgdoacnbjahbnpannfagbiddnopei.crx
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\fhnlgdoacnbjahbnpannfagbiddnopei.crx
          • Size 37KB
          • SHA256 6fa5caeaf32d280e2c3c69ab7ff41cc98c83f690deaedd7df2c9c49a869f7f6d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.ini
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\settings.ini
          • Size 592B
          • SHA256 a7efd5ae7a8f249b66099eedf435bbc7ebb1c46abc6978a4a805d2fd142ec2dd
          • MD5 SHA1 SHA512
          Submit Download

          setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zSFD9A.tmp\setup.exe
          • Size 61KB
          • SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download