Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
12-08-2024 02:31
General
-
Target
8cf6f1c86bb50f5315085e73406a657e_JaffaCakes118.exe
-
Size
819KB
-
MD5
8cf6f1c86bb50f5315085e73406a657e
-
SHA1
be23eddcd67f76f056d74a78d9943b77d937dcb7
-
SHA256
180cfdc8fc11615d1ba26c31e65c9637a20f80471f28a9a81cce42d64ff2de6e
-
SHA512
dce5fad10fe1c4722e6cb89346e03ed3e0a1d101fdbb53670583c85f754a03a831b0fff2ef6a8de22021fdaddead16086b06ee077ac34a4cb8b1eeb2f698eb0a
-
SSDEEP
24576:iQWyz/zAbdJv1UZ18Rx1zFw6d8N3ejqDXsG41X22rh3:iQlzCdJtOsZ+xXslY2
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs
Payload decoded via CertUtil.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cf6f1c86bb50f5315085e73406a657e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8cf6f1c86bb50f5315085e73406a657e_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c <nul set /p ="M" > smss.com & type lsm.com >> smss.com & del lsm.com & certutil -decode bolo.com treaz & smss.com treaz & timeout 32⤵
- Loads dropped DLL
- Deobfuscate/Decode Files or Information
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\certutil.execertutil -decode bolo.com treaz3⤵
- Deobfuscate/Decode Files or Information
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\smss.comsmss.com treaz3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\smss.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\smss.com treaz4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\smss.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\smss.com5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 3926⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD502e2ff381b200b9c997bf29f116479fd
SHA1c032a62825d66d844639887029d66488246d5145
SHA256832333a4f5387573cf38e6318897620142552121c37c74d34b7a8b144ac46658
SHA5126c91e4b223ea7af1b4d359643d82903acfe6390aeb8b93ee673dd04d77b4a67e8d41cdd3726df28693a1628d608fea736da14cc3d4c4a0f1c2b21a601bdf2704
-
Filesize
465KB
MD5cc3fc9f279af46d5eef0458f70e95e47
SHA10a64094b6c1288b67e30aeec82becade8901b8fd
SHA25608afc26de8ca609f114c84494e91742cd9e5fdd1f1af098cda38847195dc33a7
SHA512bd5e7ca039be6c0d5b2766bb7d3718925cefb60fbcdb16170a13895e979c5b128eb753d3ca3a33189ecee1b16971a4aea7e487774fdf89ba5b5a4f898b8865eb
-
Filesize
872KB
MD5d86ab2aeeac2553c7857ece4492eda5d
SHA10828db56b556f3f0486a9de9d2c728216035e8e6
SHA2568861365fb619dbb90da0027db93d041681c30deb93071ec588121a8f8ba08436
SHA5128c0154d80fb47ea5225816e95db0126d02950f0ec7909a68205ee67a0d1c4dbff971933ee5ba0307c24658ce52400e144cde720e514acf3024fbdb2505345cfe
-
Filesize
338KB
MD518a427739b484d84f982d6548d94b2a8
SHA1fac21f8e2a7fc04784dbec743548b0b9c62094d3
SHA256a3dd6dca0b0b8218f2b61cdd3bc469800424840c9b5a4d5d3e030e57085bf42a
SHA51234b19945c99e0bbc909a9d65dbfa407269613d8da84ceefaca583ebf3bcf346b7966f5dbdfee00ea8925636be6bc42bf197f1bed62de02918cce3dc33924a694
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB