Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 08:44
General
-
Target
3406b37e3f2f3e463119a65f49198222_JaffaCakes118.exe
-
Size
876KB
-
MD5
3406b37e3f2f3e463119a65f49198222
-
SHA1
8e9c476468f24fbcbf2f2cc64c70da208ee1edf3
-
SHA256
48a80366f7e52363535c9f3e836bcaa77b13808ecd57f95ba0c72c690b9f0377
-
SHA512
8383b9dbfdcaa1d4c99bcdc538e8594b4a114109e66bf7953bfc25aa2859b619ebd5dc4039d7c0d19012a61a2d3128ec99093b683308eda8150c5bc0636ed8d2
-
SSDEEP
24576:ZaGGOLdMfkd9kf2YFfLqxIWPVdBI5kgx+mbW:GOLE8kDNLqxv9lma
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3406b37e3f2f3e463119a65f49198222_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3406b37e3f2f3e463119a65f49198222_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Antivirus2008y\3406b37e3f2f3e463119a65f49198222_JaffaCakes118.exe"C:\Program Files (x86)\Antivirus2008y\3406b37e3f2f3e463119a65f49198222_JaffaCakes118.exe" /d:C:\Users\Admin\AppData\Local\Temp\3406b37e3f2f3e463119a65f49198222_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
876KB
MD53406b37e3f2f3e463119a65f49198222
SHA18e9c476468f24fbcbf2f2cc64c70da208ee1edf3
SHA25648a80366f7e52363535c9f3e836bcaa77b13808ecd57f95ba0c72c690b9f0377
SHA5128383b9dbfdcaa1d4c99bcdc538e8594b4a114109e66bf7953bfc25aa2859b619ebd5dc4039d7c0d19012a61a2d3128ec99093b683308eda8150c5bc0636ed8d2
-
Filesize
15KB
MD5c7db0de4c236aa6422326b6ed0750cbf
SHA1f91e44740e3a22783697659e363bf89554f40d91
SHA25673057583b249176131151dc6baf2918f63f2e7e0b9a4524f6f302d42779cc94f
SHA512971ca0d1a2aff6afd6e4ff81fc846466516b85dfe7373d994ca60158919f3dca37214725be7c73e561b0ae54d24e774f5469ce0065c61d94a6d28f082620482d
-
Filesize
3.2MB
-
Filesize
12KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
12KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB