Analysis
- max time kernel
150s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
11/07/2024, 19:15
General
- Target 3a69308fc69a181472bba584c49bf276_JaffaCakes118.exe
- Size 185KB
- Sample240711-xym8dazfql
- SHA256 b3b830308f3c2f3212d528ea6622c19769f8469d34d23939cdbc9c3548661d95
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a69308fc69a181472bba584c49bf276_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a69308fc69a181472bba584c49bf276_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Recycle.Bin\B6232F3A1BE.exe"C:\Recycle.Bin\B6232F3A1BE.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jKy9EEF.exe"C:\Users\Admin\AppData\Local\Temp\jKy9EEF.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
B6232F3A1BE.exe
F2BC8E6AA23B234
jKy9EEF.exe
memory/344-25-0x0000000000400000-0x0000000000469000-memory.dmp
memory/344-16-0x0000000000400000-0x0000000000469000-memory.dmp
memory/344-15-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4500-79-0x000000000244B000-0x000000000244C000-memory.dmp
memory/4500-82-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-6-0x0000000000620000-0x0000000000621000-memory.dmp
memory/4500-13-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4500-0-0x0000000002230000-0x0000000002330000-memory.dmp
memory/4500-1-0x000000000244B000-0x000000000244C000-memory.dmp
memory/4500-75-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-3-0x0000000000610000-0x0000000000611000-memory.dmp
memory/4500-76-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-77-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-4-0x0000000000400000-0x0000000000461000-memory.dmp
memory/4500-78-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-5-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4500-2-0x000000000244B000-0x000000000244C000-memory.dmp
memory/4500-67-0x0000000002230000-0x0000000002330000-memory.dmp
memory/4500-80-0x0000000000610000-0x0000000000611000-memory.dmp
memory/4500-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-7-0x0000000000620000-0x0000000000621000-memory.dmp
memory/4500-83-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-84-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-87-0x0000000000400000-0x0000000000461000-memory.dmp
memory/4500-86-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-88-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-89-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-90-0x0000000077472000-0x0000000077474000-memory.dmp
memory/4500-91-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-92-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-93-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-94-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-95-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4500-73-0x0000000000630000-0x0000000000631000-memory.dmp
memory/4500-72-0x0000000000630000-0x0000000000631000-memory.dmp
memory/4888-60-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-53-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-42-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-41-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-40-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-39-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-38-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-37-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-54-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-36-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-31-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-30-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-29-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-44-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-45-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-46-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-47-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-48-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-50-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-51-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-52-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-43-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-55-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-56-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-57-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-58-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-63-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-64-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-65-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-66-0x0000000001000000-0x0000000001004000-memory.dmp
memory/4888-68-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-69-0x0000000000B00000-0x0000000000B06000-memory.dmp
memory/4888-49-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-35-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4888-27-0x0000000001001000-0x0000000001002000-memory.dmp
memory/4888-26-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-21-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-109-0x0000000075085000-0x0000000075087000-memory.dmp
memory/4888-110-0x0000000074DD0000-0x0000000075220000-memory.dmp
memory/4888-111-0x0000000074DD0000-0x0000000075220000-memory.dmp
memory/4888-118-0x00000000021E0000-0x000000000222E000-memory.dmp
memory/4888-120-0x0000000074DD0000-0x0000000075220000-memory.dmp