d531bb88f09d76a70b36d9ef4790a736dc4c0d6ba3a63187c228fc982b533c95

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
Size

4.0MB
MD5

aaa6ce5c677b3c38cfb9f6d4e2d9f878
SHA1

153178bd2e909c827b5c8f74ac8f464247ed4314
SHA256

d531bb88f09d76a70b36d9ef4790a736dc4c0d6ba3a63187c228fc982b533c95
SHA512

164f0b28794e527c97220ad6b89a462f3fe17c061f8f93052097439965877ec15eb631197a2e82b97b50b5ec750b7dd0a90584ba4b1f261dfd39f8605c8ba42d
SSDEEP

98304:NhSf5W8Brs1+4afc3Ty1rXm+4p7hsSnl+pUo6IXp6:bGhBs1Zk7z4p7uSn1a8

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2588	_C41A.tmpac7d.exe
2992	Security Monitor.exe
2904	securitymanager.exe

Loads dropped DLL 9 IoCs

pid	Process
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Monitor 2012 Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security Monitor\\securitymanager.exe"	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Monitor 2012 Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security Monitor\\securitymanager.exe"	securitymanager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\nvllseuse68q = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe"	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security Monitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Security Monitor\\Security Monitor.exe\" /STARTUP"	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntdll.dll.log	securitymanager.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_C41A.tmpac7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security Monitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	securitymanager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
Token: SeDebugPrivilege	2992	Security Monitor.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2904	securitymanager.exe
2992	Security Monitor.exe
2992	Security Monitor.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2904	securitymanager.exe
2992	Security Monitor.exe
2992	Security Monitor.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2992	Security Monitor.exe
2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2588	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	30
PID 2564 wrote to memory of 2588	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	30
PID 2564 wrote to memory of 2588	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	30
PID 2564 wrote to memory of 2588	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	30
PID 2564 wrote to memory of 2904	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	32
PID 2564 wrote to memory of 2904	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	32
PID 2564 wrote to memory of 2904	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	32
PID 2564 wrote to memory of 2904	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	32
PID 2564 wrote to memory of 2992	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	33
PID 2564 wrote to memory of 2992	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	33
PID 2564 wrote to memory of 2992	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	33
PID 2564 wrote to memory of 2992	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	33
PID 2564 wrote to memory of 2792	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	34
PID 2564 wrote to memory of 2792	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	34
PID 2564 wrote to memory of 2792	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	34
PID 2564 wrote to memory of 2792	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	34
PID 2564 wrote to memory of 2816	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	37
PID 2564 wrote to memory of 2816	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	37
PID 2564 wrote to memory of 2816	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	37
PID 2564 wrote to memory of 2816	2564	aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe	37

C:\Users\Admin\AppData\Local\Temp\aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aaa6ce5c677b3c38cfb9f6d4e2d9f878_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\_C41A.tmpac7d.exe
  "C:\Users\Admin\AppData\Local\Temp\_C41A.tmpac7d.exe" -p"09:03 PM" -y -o"C:\Users\Admin\AppData\Roaming\Security Monitor"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2588
- C:\Users\Admin\AppData\Roaming\Security Monitor\securitymanager.exe
  "C:\Users\Admin\AppData\Roaming\Security Monitor\securitymanager.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2904
- C:\Users\Admin\AppData\Roaming\Security Monitor\Security Monitor.exe
  "C:\Users\Admin\AppData\Roaming\Security Monitor\Security Monitor.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C dir "C:\Users\Admin\AppData\Roaming"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C dir "C:\Users\Admin\AppData\Roaming\Security Monitor"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Security Monitor\Security Monitor.exe

Filesize
2.6MB

MD5
d1a205f02d52cfbe76e7af215972fbc2

SHA1
fb99f5ff06f767a77c2cde53082dc29c370f169d

SHA256
6a718429e7acaa55136562d43a939740cb2b09159839e41a3c7ced146db77443

SHA512
76ea16422680a6ee5e24ee08477e0f745699bddc4a0209e05d9948fd2dcfebcadc06dc0cdec39d4b235c73eba6ecd2f0e178db4e20d5782e8100ca36055f4c95

Download Submit
C:\Users\Admin\AppData\Roaming\Security Monitor\securitymanager.exe

Filesize
245KB

MD5
c6b032b15aeee9516d5518ee358161f7

SHA1
7deb0eeabc0ed0d8f4582ee4a6d05768dda5a483

SHA256
61657cd61e7fe001b6401b75ecfb2890e272115d7a5be4f90694a96a8523956f

SHA512
bb720b4a16ca3f167134582a18f412d18313005c3c3f0adbb2e2170357489afabf0310ede350b73b24d5ae71baea11925b0db026575bba4cb701cf49801c1668

Download Submit
\Users\Admin\AppData\Local\Temp\_C41A.tmpac7d.exe

Filesize
2.7MB

MD5
be76e3051c9d0d20fea5699195e77305

SHA1
2098c8ca26ddb73839b5fbf7c24924a3f47ebfff

SHA256
be21bc17c1f9bf15b199dca63abe20d9ea8bc01a2e4e870185ac08dfd81f7ff0

SHA512
88d2ba128fe376430624624bb9b94f8dc8104531f1d56b77cf77a7a007e62fe6aa783def0861b46b3f790d30b8a1b4083e2bdd2c68522b8add1bf15e82076c4b

Download Submit
memory/2564-0-0x0000000000400000-0x0000000000BB4000-memory.dmp

Filesize
7.7MB

Download
memory/2564-1-0x0000000002520000-0x00000000028F2000-memory.dmp

Filesize
3.8MB

Download
memory/2564-2-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2564-3-0x0000000000401000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2564-58-0x0000000000400000-0x0000000000BB4000-memory.dmp

Filesize
7.7MB

Download
memory/2564-43-0x0000000002520000-0x00000000028F2000-memory.dmp

Filesize
3.8MB

Download
memory/2564-44-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2564-46-0x0000000000401000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2564-45-0x0000000000400000-0x0000000000BB4000-memory.dmp

Filesize
7.7MB

Download
memory/2904-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2992-51-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-67-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-54-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-57-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-42-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-60-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-64-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-48-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-70-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-73-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-76-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-79-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-82-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-85-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download
memory/2992-88-0x0000000000400000-0x0000000001970000-memory.dmp

Filesize
21.4MB

Download