Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 23:37

General

  • Target

    654499039bf1ff42517df80838fe99ab_JaffaCakes118.exe

  • Size

    3.4MB

  • MD5

    654499039bf1ff42517df80838fe99ab

  • SHA1

    118944e70f2eba872846012c0324a0123d770ad8

  • SHA256

    929942325fc37a4effef061a7533af2696012025f59fda842805dd1b57b89fe5

  • SHA512

    c4e9a1704af43c1b235c03312e3b1f989a370306c301fdba85aaa299ad50b1ba7cfc9318ae0d40ff64f0ee0272d46764d67a0de442bd2c8ebcff027480a9bb11

  • SSDEEP

    49152:K1nOg6TICIjf5NppOZBv3CMVGwBlxaOfJd7h/eyDPngBy8I7YlWq4c4RveLAaSc/:inaof9s1Iw7VJ9h/J7nai+vGR2Lqcse

Malware Config

Signatures

  • Detect Neshta payload 8 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\654499039bf1ff42517df80838fe99ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\654499039bf1ff42517df80838fe99ab_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Users\Admin\AppData\Local\Temp\654499039bf1ff42517df80838fe99ab_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\654499039bf1ff42517df80838fe99ab_JaffaCakes118.exe
      2⤵
      • Checks computer location settings
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      PID:3600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    d0db0ba1489b86709ec85e3e169af310

    SHA1

    53f45f16b5f391529ee2e2acae2988322faed109

    SHA256

    d8231bf8a8979e9478e26f9cf5eb154bc9c51d5df667133dc8672b7b1d9cc4c8

    SHA512

    7ad4ecc87a0ad6328cc86621be10bda5c88168a6880cff228e85adebe0d30933193c5cd3889c45a808befdd8623da6dee50ae0c12df2efac4fb048c7b1810d4b

  • C:\Users\Admin\AppData\Local\Temp\3582-490\654499039bf1ff42517df80838fe99ab_JaffaCakes118.exe

    Filesize

    3.4MB

    MD5

    d47ca1594d2780f0e736b244764e2e80

    SHA1

    a15414dfd48343e9ce0c179fe211943e86c12820

    SHA256

    4157c73809436b2214812f30cdc79c800562f08cc1ad1a0bcdf6d86bbf682d21

    SHA512

    491f53c5ebce04e93a6f755a5fa4fe19fe34bd381278ab620baf4d68adc9684f6c5855859de9bb8d2c82b58938caedd2670fec5c8a35dbe04db55f8b859379ef

  • memory/3600-6-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3600-4-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3600-3-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3600-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3600-100-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3600-101-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3600-102-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3600-104-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB