Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
13/08/2024, 19:31
General
-
Target
946ed920ed4742daf02adf9b221146b6_JaffaCakes118.exe
-
Size
876KB
-
MD5
946ed920ed4742daf02adf9b221146b6
-
SHA1
0b302d169c147b4b80082214ae749eac109469f3
-
SHA256
b476ca249855b31da9affd9a8cf153ccb4d19250c6340f6294e9da67d208278e
-
SHA512
0e3c539a1e4c1d604f0cba6173788b47120eca9406b729a38981e12c1912c48b61312626e19f6a880736c7a4ac74e1afaa86e41b4173a094c9857312190229ae
-
SSDEEP
24576:GVbJ96RIltyqrJ3arIORDS4tlNhifGSgEv:GVl9YIiuJ3sFtln6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\946ed920ed4742daf02adf9b221146b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\946ed920ed4742daf02adf9b221146b6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Antivirus2008y\946ed920ed4742daf02adf9b221146b6_JaffaCakes118.exe"C:\Program Files (x86)\Antivirus2008y\946ed920ed4742daf02adf9b221146b6_JaffaCakes118.exe" /d:C:\Users\Admin\AppData\Local\Temp\946ed920ed4742daf02adf9b221146b6_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x55c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
876KB
MD5946ed920ed4742daf02adf9b221146b6
SHA10b302d169c147b4b80082214ae749eac109469f3
SHA256b476ca249855b31da9affd9a8cf153ccb4d19250c6340f6294e9da67d208278e
SHA5120e3c539a1e4c1d604f0cba6173788b47120eca9406b729a38981e12c1912c48b61312626e19f6a880736c7a4ac74e1afaa86e41b4173a094c9857312190229ae
-
Filesize
15KB
MD5c7db0de4c236aa6422326b6ed0750cbf
SHA1f91e44740e3a22783697659e363bf89554f40d91
SHA25673057583b249176131151dc6baf2918f63f2e7e0b9a4524f6f302d42779cc94f
SHA512971ca0d1a2aff6afd6e4ff81fc846466516b85dfe7373d994ca60158919f3dca37214725be7c73e561b0ae54d24e774f5469ce0065c61d94a6d28f082620482d
-
Filesize
12KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
12KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
64KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
64KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
64KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB