Analysis

  • max time kernel
    142s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24-06-2024 20:04

General

  • Target

    0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe

  • Size

    122KB

  • MD5

    0a96bd53360b6643433af526a6e45147

  • SHA1

    eff01ea8859f8f00b6c5cce0752bd1185a7c4319

  • SHA256

    3d3f3cb48f83da5a880e184ed9424cc932922da7a4b4e5f6e44e5061024075fc

  • SHA512

    c1cf6030a84a77da453e9ac64beee51a8f74cb767540946f527b5e3e11463cd141326a211a8a1ef2f4dd8da78047da457dd9c1a9ac5bc568dd8f381fd5561855

  • SSDEEP

    3072:CBAhwPVF+LCOKOyQ7GTdWtHgP3X9EH9R823:CBA+TOyQOotH63X94z

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
        PID:2352
      • C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
        2⤵
          PID:2860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\540C.85F

        Filesize

        300B

        MD5

        d1411eeb5902bbe4aecfe7ac8d5278ed

        SHA1

        60a245d3a7dfc79158031036f9b7fd751f7a702b

        SHA256

        753d4d66e3e04d9ebe25e20f7c563636b78fa7bdb926fe1f377246612ac808db

        SHA512

        d6562a2fbc5a20b6de0944afed194adc8eb16f20b6157335487747a8920f1f21c9da6c5399546b95d98dbae5f3b3af4444747dbf0dddbeae526cb4173fbc67c8

      • C:\Users\Admin\AppData\Roaming\540C.85F

        Filesize

        1KB

        MD5

        2e328201b6958ad5e0238d58a742e9f0

        SHA1

        8ff7a1d7dd98a7939f07b0245b76815cfa72991b

        SHA256

        35d1189bf987f3cb01d6cef6522694d3adc8f7c31407a8c98a7daf6b1cad08b3

        SHA512

        014b0f5b27f8cd480c7c9e3486e56928feb4c3b0d3a612b62c61ab1d7341a7d2656208e9a12277d439144487d8810d603c85051c450b22f76241b0b7478d39b5

      • C:\Users\Admin\AppData\Roaming\540C.85F

        Filesize

        696B

        MD5

        2e1e1ab47ddfe31ee617cca85519fe4e

        SHA1

        eb87ac29fe0e4a13bc6a3d8ea52ac62132834a51

        SHA256

        33d708b86bdcf354ed5b87e97d0a7b315f5ecbead8875a7ddf5de0e266aef02f

        SHA512

        b4e9a18cb4e4981bc7873c113908d4fb10ae2e6217c9c9e91a6605c28b30ff00b7e2674507e8ec419716f7cf2934e49741346200e76a8f490512256096d10763

      • memory/1232-2-0x0000000000400000-0x0000000000431000-memory.dmp

        Filesize

        196KB

      • memory/1232-65-0x0000000000400000-0x0000000000431000-memory.dmp

        Filesize

        196KB

      • memory/1232-73-0x0000000000400000-0x0000000000431000-memory.dmp

        Filesize

        196KB

      • memory/1232-165-0x0000000000400000-0x0000000000431000-memory.dmp

        Filesize

        196KB

      • memory/2352-5-0x0000000000400000-0x0000000000431000-memory.dmp

        Filesize

        196KB

      • memory/2860-72-0x0000000000400000-0x0000000000431000-memory.dmp

        Filesize

        196KB