Analysis

  • max time kernel
    139s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-07-2024 02:05

General

  • Target

    5e9f7a18635ca833a485a331cc6433a1_JaffaCakes118.exe

  • Size

    211KB

  • MD5

    5e9f7a18635ca833a485a331cc6433a1

  • SHA1

    4fa2420f03b2224fdae3d2c04232fe159fc11b83

  • SHA256

    2cb4194df2601eb963d74c4c967a058a65a47b36f33372d63d8d8c29586f668e

  • SHA512

    73f287caa653fa627f57370c9e97c0d255ee2374ad61d8d5b630360e2e1f7b38d0b0d660150a6d4b7e185fa6a85b692e1758155b315a1dc97c35954711c8a25b

  • SSDEEP

    1536:yxqjQ+P04wsZLnDrCaHjzLAQH7Z+umA2LE4sX/a7Z0N/ZnPX8HjzLAQH7mV5DgTW:zr8WDrCm+MMktXRkOJgXdZt9P6D3XJ

Malware Config

Signatures

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e9f7a18635ca833a485a331cc6433a1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5e9f7a18635ca833a485a331cc6433a1_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Users\Admin\AppData\Local\Temp\3582-490\5e9f7a18635ca833a485a331cc6433a1_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\5e9f7a18635ca833a485a331cc6433a1_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      PID:2068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

    Filesize

    2.4MB

    MD5

    d9e8a1fa55faebd36ed2342fedefbedd

    SHA1

    c25cc7f0035488de9c5df0121a09b5100e1c28e9

    SHA256

    bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

    SHA512

    134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

  • C:\Users\Admin\AppData\Local\Temp\3582-490\5e9f7a18635ca833a485a331cc6433a1_JaffaCakes118.exe

    Filesize

    171KB

    MD5

    0b70b3c63a74c10371d517b8d0c99e04

    SHA1

    6afb47bd5f49320317705f8041a55065a3ce2b45

    SHA256

    c5b1bf1d9d67d01ba2332a42026baee86a1809ef86cb7680ab735912b2fd6df4

    SHA512

    5f911b796c284abe550ecfdf037484fd518c47c25ce741ea568a7913670832defe44c41c02cb970dd48ff07e1b5223e02c9949d9b7ac9b939ab496511fdb4264

  • memory/3704-94-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3704-95-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3704-97-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB