Analysis
-
max time kernel
142s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe
-
Size
122KB
-
MD5
0a96bd53360b6643433af526a6e45147
-
SHA1
eff01ea8859f8f00b6c5cce0752bd1185a7c4319
-
SHA256
3d3f3cb48f83da5a880e184ed9424cc932922da7a4b4e5f6e44e5061024075fc
-
SHA512
c1cf6030a84a77da453e9ac64beee51a8f74cb767540946f527b5e3e11463cd141326a211a8a1ef2f4dd8da78047da457dd9c1a9ac5bc568dd8f381fd5561855
-
SSDEEP
3072:CBAhwPVF+LCOKOyQ7GTdWtHgP3X9EH9R823:CBA+TOyQOotH63X94z
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1232-2-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/2352-5-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1232-65-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/2860-72-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1232-73-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1232-165-0x0000000000400000-0x0000000000431000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe" 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1232 wrote to memory of 2352 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 28 PID 1232 wrote to memory of 2352 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 28 PID 1232 wrote to memory of 2352 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 28 PID 1232 wrote to memory of 2352 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 28 PID 1232 wrote to memory of 2860 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 30 PID 1232 wrote to memory of 2860 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 30 PID 1232 wrote to memory of 2860 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 30 PID 1232 wrote to memory of 2860 1232 0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵PID:2352
-
-
C:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0a96bd53360b6643433af526a6e45147_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300B
MD5d1411eeb5902bbe4aecfe7ac8d5278ed
SHA160a245d3a7dfc79158031036f9b7fd751f7a702b
SHA256753d4d66e3e04d9ebe25e20f7c563636b78fa7bdb926fe1f377246612ac808db
SHA512d6562a2fbc5a20b6de0944afed194adc8eb16f20b6157335487747a8920f1f21c9da6c5399546b95d98dbae5f3b3af4444747dbf0dddbeae526cb4173fbc67c8
-
Filesize
1KB
MD52e328201b6958ad5e0238d58a742e9f0
SHA18ff7a1d7dd98a7939f07b0245b76815cfa72991b
SHA25635d1189bf987f3cb01d6cef6522694d3adc8f7c31407a8c98a7daf6b1cad08b3
SHA512014b0f5b27f8cd480c7c9e3486e56928feb4c3b0d3a612b62c61ab1d7341a7d2656208e9a12277d439144487d8810d603c85051c450b22f76241b0b7478d39b5
-
Filesize
696B
MD52e1e1ab47ddfe31ee617cca85519fe4e
SHA1eb87ac29fe0e4a13bc6a3d8ea52ac62132834a51
SHA25633d708b86bdcf354ed5b87e97d0a7b315f5ecbead8875a7ddf5de0e266aef02f
SHA512b4e9a18cb4e4981bc7873c113908d4fb10ae2e6217c9c9e91a6605c28b30ff00b7e2674507e8ec419716f7cf2934e49741346200e76a8f490512256096d10763