Overview

overview

7

Static

static

3

a515637471...18.exe

windows7-x64

7

a515637471...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 02:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe

  • Size

    33KB

  • MD5

    a51563747130d0795c8f53fe3f12f9ae

  • SHA1

    e930abaf1331f97a497dc7d6088154906541869b

  • SHA256

    4f6bc0019b51f2fa6eb9ddb83860d35196a34e51db24706a9f8d42c3821ed438

  • SHA512

    388747aea615f512fe2102b222b6d1023a9978feeb2b3491db7f140fbf7738b2997792a20e7a7d4309efa84b436b54468c5826d5501d9a447851b538f9d40b97

  • SSDEEP

    768:I0X7HC9hO5RroZJ767395uINnEfDKBbUCp1OTZ+/V:Ici9he+Zk77RNzLiTO

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3412
      • C:\Users\Admin\AppData\Local\Temp\a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe"
        2⤵
        • Drops startup file
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3916
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2428
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1492
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
      Filesize

      250KB

      MD5

      31dd0a6e1d579f2c6154cc8c001200da

      SHA1

      59f80ef5fba7f8ec72cf38c7661966f76ece666c

      SHA256

      dc987ba880cc21874a898a2f917298f256dca49d30520a25d2f7d47e13436d76

      SHA512

      6e973421c1bfe82523c9d7dbe53958a07c256b201287e6ec71dc4fffda9ac2ab51c0e6b5bd3a47dbef20355d217d6e36761b8251f7f3b2caab4c0fab8b325c43

      Download Submit

    • C:\Program Files\dotnet\dotnet.exe
      Filesize

      176KB

      MD5

      07fab83758b73de8bf239382c9425d89

      SHA1

      4ecd562daaa3bd4face709eefb61bc1d9e301ca0

      SHA256

      e15b757e91bdbd4d60f6d3f411c2f50581aaab2d4f29f1228e6d4d6820e9ab4b

      SHA512

      555158396d4e67a81a9cd6e0beed739cee1983eec0885bbcd98b70c66348376f17a36024e1dac9ef4da498dfef388f87f9667b0ef12b8dab62a4f87a3ed0d02f

      Download Submit

    • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
      Filesize

      643KB

      MD5

      a5d877ddb05e13f657da9a470f10bd7c

      SHA1

      0e06863bb66b72b01d0120f89a176a13ffccc6cc

      SHA256

      5fba16468f3e99ea99a8b3007a6d4a34ddcbedcf757c192f0eaf707297414777

      SHA512

      aa28dca40bbc144f40dec11b83cbb4ed746f3f74c831318c2eea0d5d4108ed6452485f30ab7f697114e19b48d4b256580042a542ebd65dacacea5e5384f600ed

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-786284298-625481688-3210388970-1000\_desktop.ini
      Filesize

      9B

      MD5

      36657916738d378a6daf6ec7b690badd

      SHA1

      e4d3726bd02e1e99b12ada04a242fd6ef7c2843c

      SHA256

      7cd83d4ff3f3c6844b544fa7790bc1e7ed8bf829627657544861ac726071831c

      SHA512

      b7878056ad1c2294fb0e659eee6c7861948010b69a43930d8a243f61cebbea83fcd6fb11db19c01f731a925a7a744c6cc4de2eb0ffdc3863acf71e4cc05b2d6b

      Download Submit

    • memory/4532-0-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4532-3-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4532-2825-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4532-8848-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download