276fb9aaa5891fa085559bd168176203d14a1c97df09f05fd496fa060d79cb10

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26b4243db442d797e817c44953544e55_JaffaCakes118.exe
Size

5.8MB
MD5

26b4243db442d797e817c44953544e55
SHA1

b662ee7df1e0b040b8b6ba986c73a278647b94d9
SHA256

276fb9aaa5891fa085559bd168176203d14a1c97df09f05fd496fa060d79cb10
SHA512

b85958026650086e4be6023d3a7d0cc679ff8af734bd6ae10acd87bab902964099cf668456e177ec69c7d5b90718ee1b624e258eee3e169bbfb9956dbbb3ac7d
SSDEEP

98304:J5FCaCZBwYHfuJTczPN2vF9/bJV3yYsOvHtQF6InPSgfDJBNBpKZJT:J2BxmJTQl2vP/bJVCTVF68TNyPT

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2876	ApnStub.exe

Loads dropped DLL 6 IoCs

pid	Process
1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe
2876	ApnStub.exe
2876	ApnStub.exe
1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe
1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe
1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2876	1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe	28
PID 1980 wrote to memory of 2876	1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe	28
PID 1980 wrote to memory of 2876	1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe	28
PID 1980 wrote to memory of 2876	1980	26b4243db442d797e817c44953544e55_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\26b4243db442d797e817c44953544e55_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26b4243db442d797e817c44953544e55_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\ApnStub.exe
  "C:\Users\Admin\AppData\Local\Temp\ApnStub.exe" /tb=IMB
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\APNIC.dll

Filesize
240KB

MD5
ed92900bf225e26a4e54c2c14fa1424f

SHA1
e32aa2e78d2c8f0e9316080e71a714befe851e6c

SHA256
b284311140c80784af8f5b01550b0d7eb4b0d64cf2037800cc284856c1ff4740

SHA512
9e3c7571e2bd2a2ec6d842064b2b310a018bafa7125639135240485625252989d3c0ac5d18c7b4a88835aa8aac67ac2521237dbd757e0ae652ecf39b723e314d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd22FD.tmp\ioSpecial.ini

Filesize
497B

MD5
7a9b9a45c678d6b1acb234251d39ac22

SHA1
cad30801e4dc65df167b5e5817a30dca19b5a3e6

SHA256
ea274fc56c89226353ebc7d446b10fa43732ed2cc4ea81e18702223dad363ad1

SHA512
4917373b036f822b8df5b6b48b81e796049de69ee6c67e6258cb086d9ca0889b0c5e74ee2f43f3723f6effb2aaedf566000ffd17cfa10b747121f44419c7fe51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd22FD.tmp\ioSpecial.ini

Filesize
536B

MD5
b5b454a9ee2f417fde8ddc9938373935

SHA1
3aba5b420217be6c81452de00e52b4da6da45ddd

SHA256
a6e97c231635a191834e8ece8881172f605625dd2d49308f1257a53b9b5d9129

SHA512
84fe1780b4e3289ac471d77e07824aa2ecba6010629fc0078019f56353cea13db4b000ad8f3f5cc3c6502b58fc8c4dc937c5c33b3d5bb75410f5f23fd98e7733

Download Submit
\Users\Admin\AppData\Local\Temp\ApnStub.exe

Filesize
139KB

MD5
c36923084822c017f69396418a999d39

SHA1
fdc2005ced8acf86c68fe1b86b0698d0539e8ce0

SHA256
7a158fdeea8f7107be5ce40242546a503193aa1c278f74a4730871b8edd0ba76

SHA512
fb1106d4f4a138cad28a4282cb00c72688e03610be1d31a7cdd7b42b23e00e4f7ca9e731a7ab016d5920411707e165e3ee48164ef520112d8ac36fad85749c44

Download Submit
\Users\Admin\AppData\Local\Temp\nsd22FD.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsd22FD.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit