Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 06:11

General

  • Target

    488e22d7fefe8ac231d2da624ad96498_JaffaCakes118.exe

  • Size

    4.4MB

  • MD5

    488e22d7fefe8ac231d2da624ad96498

  • SHA1

    c3ae5927011b05ffab8f621b39ef82402754181d

  • SHA256

    d32b094a2764078bf688d43a4fb94d237c2df90c5dd522ea74c95e19adc46e4f

  • SHA512

    12feed704854f45bd036236f058caa50bec6bed4f2f822bd6d0f59ebf76c9b24d4af78406159a800828155993cf02201d65b1168d4958ee59966e4731aadcc1d

  • SSDEEP

    98304:2DrVIXQGHHmg/HoHoxCQ8b/ahNlkQuyPgIhgp0wTA:OIXnjvoHo8QkahNSQucxupzk

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\488e22d7fefe8ac231d2da624ad96498_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\488e22d7fefe8ac231d2da624ad96498_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\_692F.tmpac7d.exe
      "C:\Users\Admin\AppData\Local\Temp\_692F.tmpac7d.exe" -p"09:03 PM" -y -o"C:\Users\Admin\AppData\Roaming\Security Monitor 12"
      2⤵
      • Executes dropped EXE
      PID:2728
    • C:\Users\Admin\AppData\Roaming\Security Monitor 12\securitymanager.exe
      "C:\Users\Admin\AppData\Roaming\Security Monitor 12\securitymanager.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3012
    • C:\Users\Admin\AppData\Roaming\Security Monitor 12\123.exe
      "C:\Users\Admin\AppData\Roaming\Security Monitor 12\123.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DRMCommoncdrom.dll", isaapiplugin UtilGLspl
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1060
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\ieEventVdm\eapMobile90.dll",isaapiplugin nsCommonlib
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1600
    • C:\Users\Admin\AppData\Roaming\Security Monitor 12\Security_Monitor2012.exe
      "C:\Users\Admin\AppData\Roaming\Security Monitor 12\Security_Monitor2012.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2584
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C dir "C:\Users\Admin\AppData\Roaming"
      2⤵
        PID:600
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C dir "C:\Users\Admin\AppData\Roaming\Security Monitor 12"
        2⤵
          PID:664

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_692F.tmpac7d.exe

        Filesize

        2.7MB

        MD5

        45f906b15c0a53a1688e792fa9f05d5e

        SHA1

        e3651d7c78869bdd686adab9277b479fa275f72b

        SHA256

        55cf03c9d94c6c4ca06f994ff63ced67cce69656ca6805632ab213d4e508ba9c

        SHA512

        d93b751be6c92f69efb363079e259fe10691545ad4b02ac39028bfc185bf698b17aef98722980b1bc5de0f45d8172b242bb5729bcc65217d559cb7c1c8452169

      • C:\Users\Admin\AppData\Roaming\Security Monitor 12\123.exe

        Filesize

        128KB

        MD5

        affff428b96e72947df0b159b042489c

        SHA1

        3c2648d0b9b235268acd37577a3a347e56774f7e

        SHA256

        60aee595074d9e8ddf8e27e6bd5aca6990d3591edac4f5c9eac31de4ea7a3778

        SHA512

        23d8b474176eaa5b2b865ea408f2054df354417ff47f4d9ef2bfbb9d5700035b141f7de997adbdd48d76e3b88ba34eb45b952601b8f7fc22e960f87e6f84f8b3

      • C:\Users\Admin\AppData\Roaming\Security Monitor 12\Security_Monitor2012.exe

        Filesize

        2.8MB

        MD5

        6dcaabfdc99c0b22ee13614a22e59a42

        SHA1

        9d9d3cf2bf3cbd471a76beb6cd57499a3f727460

        SHA256

        1152efbb8547564f5580a870d0b60efaa5898f9264de0c400544f8b354d34c44

        SHA512

        acc738dc83e2f51c9dac458d896d0c581881ac1528dc47773abbc95c344acef1fc83251edfcd093e62c442d104cad72b8b5adadc85cc032f0e6a0fe088350d2a

      • C:\Users\Admin\AppData\Roaming\Security Monitor 12\securitymanager.exe

        Filesize

        645KB

        MD5

        1e0af74d8e1d00bfeb97faf4cc9d3b82

        SHA1

        4b9b185c71aee14a7b1ca873780028ad8609a0bd

        SHA256

        acbbd26008134ea347438dd270fc36c152585839d10fe5988ae1df0f62e7ac32

        SHA512

        efb2375ff173000a7ea1cb03c6922b4b085c4c84ccccfffb3dc6f07c0c3d398d3992a80266f1297df9046e519fbdf915aebb4e4fec4e607586d3dc62d4105df3

      • \Users\Admin\AppData\Local\Temp\DRMCommoncdrom.dll

        Filesize

        156KB

        MD5

        3454b7805cb0971ceab4e9c3c6c7c523

        SHA1

        110048071b101fdc9460381d5ab8a7213813f283

        SHA256

        7defbf9dfc04bd9f60566cd5a83f14118e7259cd3cc907d9eff0378d80ef8e72

        SHA512

        0a69a092e8e2eedcd52fa633354b1069c3e37d82c54c2d82ccc3f4ca7053d20b0ab61afe877d960f4e88a765c5f0fdb612ad4ea2b0806ad995fdbb6116bea1e0

      • memory/1632-58-0x0000000000400000-0x00000000007B1000-memory.dmp

        Filesize

        3.7MB

      • memory/2584-81-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-94-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-109-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-106-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-103-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-100-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-97-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-66-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-49-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-69-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-91-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-88-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-75-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-85-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2584-78-0x0000000000400000-0x0000000001931000-memory.dmp

        Filesize

        21.2MB

      • memory/2780-2-0x00000000002D0000-0x00000000002D1000-memory.dmp

        Filesize

        4KB

      • memory/2780-76-0x0000000000400000-0x0000000000BB6000-memory.dmp

        Filesize

        7.7MB

      • memory/2780-71-0x00000000002D0000-0x00000000002D1000-memory.dmp

        Filesize

        4KB

      • memory/2780-72-0x0000000000401000-0x00000000005C6000-memory.dmp

        Filesize

        1.8MB

      • memory/2780-70-0x0000000002530000-0x0000000002905000-memory.dmp

        Filesize

        3.8MB

      • memory/2780-64-0x0000000000400000-0x0000000000BB6000-memory.dmp

        Filesize

        7.7MB

      • memory/2780-3-0x0000000000401000-0x00000000005C6000-memory.dmp

        Filesize

        1.8MB

      • memory/2780-1-0x0000000000400000-0x0000000000BB6000-memory.dmp

        Filesize

        7.7MB

      • memory/2780-0-0x0000000002530000-0x0000000002905000-memory.dmp

        Filesize

        3.8MB

      • memory/3012-65-0x0000000000400000-0x00000000004A4000-memory.dmp

        Filesize

        656KB