Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 21:04

General

  • Target

    64cd2cba12f50a6d38186c0bbe417dbb_JaffaCakes118.exe

  • Size

    288KB

  • MD5

    64cd2cba12f50a6d38186c0bbe417dbb

  • SHA1

    cc732b389200b103959ef0b3bfb908c35a66d1b7

  • SHA256

    76133759d07a9dfb39a2c8727ec8fe7a74a5fe3682e5f906157307546524502b

  • SHA512

    ddebf33076b84390e3d64ed7ff3786a9bea30a802441262ca415d16f473b31f225872620b91a77a2776da9c15fb1dfd5a1d765e83f76dc003743024fbafd2d3e

  • SSDEEP

    6144:xwAcCviSDQUD2yiM/32gWkqBBl6acYMiE2zEbr6lKE1mOjhwai:LjdlEgMUYlBWelbmCVi

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64cd2cba12f50a6d38186c0bbe417dbb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\64cd2cba12f50a6d38186c0bbe417dbb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\uninstall.exe
      "C:\Users\Admin\AppData\Local\Temp\uninstall.exe" /remove
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\uninstall.exe

    Filesize

    288KB

    MD5

    64cd2cba12f50a6d38186c0bbe417dbb

    SHA1

    cc732b389200b103959ef0b3bfb908c35a66d1b7

    SHA256

    76133759d07a9dfb39a2c8727ec8fe7a74a5fe3682e5f906157307546524502b

    SHA512

    ddebf33076b84390e3d64ed7ff3786a9bea30a802441262ca415d16f473b31f225872620b91a77a2776da9c15fb1dfd5a1d765e83f76dc003743024fbafd2d3e