Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 02:52
Static task
static1
Behavioral task
behavioral1
Sample
ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe
-
Size
55KB
-
MD5
ce7a9c23cc40bf8267571700fccf7354
-
SHA1
5c027596f6414cd3260604568f9b51e7704677a1
-
SHA256
e4aac46df25f7f2476deca1730b4860eff62047ed4edd3bdec25dda81d49ba68
-
SHA512
c718e6f99deb186299404e18d1202ae71b5ac28e902dc40e869c9006be3943af92f7e90357283613a5637b60ef93683f6841de72b0239973af1847cafdf68341
-
SSDEEP
1536:BOf4qaGj3eHuMDMMG/Rz5cYx7S4LMv9PtTjgU:BCwPHu/MARRxG4YNt3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exeC:\\Users\\Admin\\AppData\\Roaming\\appconf32.exe," TSTheme.exe -
Deletes itself 1 IoCs
pid Process 2728 TSTheme.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSTheme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" TSTheme.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" TSTheme.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main TSTheme.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe 2728 TSTheme.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2728 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2728 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2728 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2728 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2728 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2728 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2728 2060 ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe 30 PID 2728 wrote to memory of 2192 2728 TSTheme.exe 31 PID 2728 wrote to memory of 2192 2728 TSTheme.exe 31 PID 2728 wrote to memory of 2192 2728 TSTheme.exe 31 PID 2728 wrote to memory of 2192 2728 TSTheme.exe 31 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32 PID 2728 wrote to memory of 2376 2728 TSTheme.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\TSTheme.exeC:\Windows\system32\TSTheme.exe2⤵
- Modifies WinLogon for persistence
- Deletes itself
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2192
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- System Location Discovery: System Language Discovery
PID:2376
-
-