Overview

overview

7

Static

static

3

625ec69aab...18.exe

windows7-x64

7

625ec69aab...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 07:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    625ec69aabd2c7cdaad57c5d99fe448a_JaffaCakes118.exe

  • Size

    5.5MB

  • MD5

    625ec69aabd2c7cdaad57c5d99fe448a

  • SHA1

    21ed3e61751fed14f66664ee602256ae2990f5ed

  • SHA256

    2cac0a3c9513abf82654882e258c507865fd299b2215ebe57706047bcfa88ee8

  • SHA512

    65e704fe86b8aa63d05b6d30fbfcd1db7a03ec28c423cefd62742b0c1b339f60e4b5793d5e7b3c9d8eb907ffbff1bcac45d0df435fe7e5650073c580bbf5f3bf

  • SSDEEP

    49152:QkIW2QmzKALbdlGzlbiObpCdjN081PKkD7KdZ0d/oBbhu9y7LipnFYjL0j/dr4Zt:Z

Score
7/10
spywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\625ec69aabd2c7cdaad57c5d99fe448a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\625ec69aabd2c7cdaad57c5d99fe448a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\Morpion.exe
      "C:\Users\Admin\AppData\Local\Temp\Morpion.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Users\Admin\AppData\Local\Temp\Morpion.exe
        C:\Users\Admin\AppData\Local\Temp\Morpion.exe
        3⤵
        • Executes dropped EXE
        PID:4712
    • C:\Users\Admin\AppData\Local\Temp\Mediator1.exe
      "C:\Users\Admin\AppData\Local\Temp\Mediator1.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:5012

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Mediator1.exe
          Filesize

          3.8MB

          MD5

          f0dd80223af71fd59577a7b85766383f

          SHA1

          35a92dfcc22141ce662391ead91ae1bd47b8de6d

          SHA256

          79a6fee7c465297e8eac44a117999da57fd26b415bcc9f637b4120a05ad43bf3

          SHA512

          d9d3423b209c9e01ca5361341c9e2d53b47534e9cdb65971b840c1087710ab7193074282b65e6a2c4f446bda135d877ed26968ce25d6d8fd0b0f3d5bfef566e1

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Morpion.exe
          Filesize

          388KB

          MD5

          d56b407114e3b4a1611846ac23eaeedf

          SHA1

          4ba09a0bfb9ad1ebc0b26c1dcd55857bb36234c2

          SHA256

          d52d2b26df8f3f5fbcba9aab0b8888aa25ea63c753aecda81a28190a5c0004dc

          SHA512

          568066f3ccf0e5386e2d592ba4987999d5a9698bf43e6d90f68dacaa16a2b35b9a3ad2ae80feb3593a7c1d3288b7a2c1351bb8789b11380ed1ea63ba3d2c9d6b

          Download Submit

        • memory/4572-3-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/4572-0-0x00007FFA7A185000-0x00007FFA7A186000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4572-4-0x000000001C370000-0x000000001C40C000-memory.dmp

          Filesize

          624KB

          Download

        • memory/4572-5-0x0000000001280000-0x0000000001288000-memory.dmp

          Filesize

          32KB

          Download

        • memory/4572-6-0x000000001C480000-0x000000001C4CC000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4572-7-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/4572-2-0x000000001BE00000-0x000000001C2CE000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/4572-1-0x000000001B7A0000-0x000000001B846000-memory.dmp

          Filesize

          664KB

          Download

        • memory/4572-33-0x00007FFA79ED0000-0x00007FFA7A871000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/4712-37-0x0000000000400000-0x0000000000458000-memory.dmp

          Filesize

          352KB

          Download

        • memory/4712-34-0x0000000000400000-0x0000000000458000-memory.dmp

          Filesize

          352KB

          Download

        • memory/4712-41-0x0000000000400000-0x0000000000458000-memory.dmp

          Filesize

          352KB

          Download