0616815f878768a3b5b1c371c131645676c8624ccd2c091f561876bef14ff695

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe
Size

256KB
MD5

5feb9a87f8d6ca48b7d85c709989d0cb
SHA1

7dad6b74f4c7076f4fb5c3416dce2ee0d8f439bc
SHA256

0616815f878768a3b5b1c371c131645676c8624ccd2c091f561876bef14ff695
SHA512

e3da0de1b993521cbdef54bf02ac0fa8062d5ec3160eaf8a1f8a9b1b80b0f4b353129da865bea33cce4e111da85c802dc45f338a634f3acef2ac53d84d9b9126
SSDEEP

6144:nmsl1nSuzsNHE/6SJfPvJeg/6SJfYMbes/6SJfPvJeg/6SJf:m0ngNkiSfiSe0iSfiS

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2540	outlook.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\sys32.exe"	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\outlook.exe	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe
File opened for modification	C:\Windows\outlook.exe	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe
File opened for modification	C:\Windows\sys32.exe	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe
File opened for modification	C:\Windows\outlook.cfg	outlook.exe
File created	C:\Windows\sys32.exe	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2540	1604	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe	30
PID 1604 wrote to memory of 2540	1604	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe	30
PID 1604 wrote to memory of 2540	1604	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe	30
PID 1604 wrote to memory of 2540	1604	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe	30
PID 1604 wrote to memory of 2540	1604	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe	30
PID 1604 wrote to memory of 2540	1604	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe	30
PID 1604 wrote to memory of 2540	1604	5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5feb9a87f8d6ca48b7d85c709989d0cb_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\outlook.exe
  C:\Windows\outlook.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\outlook.cfg

Filesize
251B

MD5
20f4d13a9c89a8a61c56d366d7e9cf28

SHA1
d13fa41f51ec0156c96ac6bce3abec2180770ca7

SHA256
f80726f907654c7c0b7a87e73575a85ac848b369ad6524a8c249f9da9c73d7a8

SHA512
c2a1d3854ac2d949c0da3a226c0fda573ba8ceec7f8b0b3a3e7755c7cf5a9421680f784034f13c02538dbb4dcceeae62de87efd9c7e77ae8b561762bdacdc33a

Download Submit
C:\Windows\outlook.cfg

Filesize
645B

MD5
dd2c04c66994d349e5f882265f10524d

SHA1
7ffb863300e8072c5f78bfb8d0d0636076b08d74

SHA256
e38d4124d31663dcdfe094122ebb1dfe16dbfd9e8d8e89c4fac99ed4f03d7ed8

SHA512
90fde182ecb9801ec917ac33113efd2a06badccb4c14885b90e0011d5d426722e98e9c450dd3d7a3a6a97dab366e52c720065bfa081de649f3f3a19090057de9

Download Submit
C:\Windows\outlook.exe

Filesize
49KB

MD5
0e9379e357aba95f8b9883af9b67675e

SHA1
280a174a414e5b8588f42b6328af2c8c8ff4394f

SHA256
96b9c4ead67d03eb2c69103a983274e013e3466e80d8f95bd7cf3aea8be05b28

SHA512
6cc383806882729cd889b025802ac0d5e1c55a74b3e7d7c98932644e8802fe52b5b14a886eff70ab7deaa70fb60bb9898e55b5cd83b5b99e2a2d107dce367784

Download Submit
memory/1604-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1604-26-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2540-58-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2540-68-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads