Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06-09-2024 02:52

General

  • Target

    ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe

  • Size

    55KB

  • MD5

    ce7a9c23cc40bf8267571700fccf7354

  • SHA1

    5c027596f6414cd3260604568f9b51e7704677a1

  • SHA256

    e4aac46df25f7f2476deca1730b4860eff62047ed4edd3bdec25dda81d49ba68

  • SHA512

    c718e6f99deb186299404e18d1202ae71b5ac28e902dc40e869c9006be3943af92f7e90357283613a5637b60ef93683f6841de72b0239973af1847cafdf68341

  • SSDEEP

    1536:BOf4qaGj3eHuMDMMG/Rz5cYx7S4LMv9PtTjgU:BCwPHu/MARRxG4YNt3

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ce7a9c23cc40bf8267571700fccf7354_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\TSTheme.exe
      C:\Windows\system32\TSTheme.exe
      2⤵
      • Modifies WinLogon for persistence
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer Protected Mode
      • Modifies Internet Explorer Protected Mode Banner
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:2192
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2376

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2060-1-0x00000000001C0000-0x00000000001CD000-memory.dmp

      Filesize

      52KB

    • memory/2060-2-0x00000000001C0000-0x00000000001CD000-memory.dmp

      Filesize

      52KB

    • memory/2060-4-0x00000000001C0000-0x00000000001CD000-memory.dmp

      Filesize

      52KB

    • memory/2060-0-0x00000000001C0000-0x00000000001CD000-memory.dmp

      Filesize

      52KB

    • memory/2060-8-0x00000000001C0000-0x00000000001CD000-memory.dmp

      Filesize

      52KB

    • memory/2376-29-0x0000000000020000-0x000000000002D000-memory.dmp

      Filesize

      52KB

    • memory/2376-38-0x0000000074BF0000-0x0000000074D00000-memory.dmp

      Filesize

      1.1MB

    • memory/2376-36-0x0000000074BF0000-0x0000000074D00000-memory.dmp

      Filesize

      1.1MB

    • memory/2376-34-0x0000000000130000-0x000000000013D000-memory.dmp

      Filesize

      52KB

    • memory/2376-31-0x0000000074BF0000-0x0000000074D00000-memory.dmp

      Filesize

      1.1MB

    • memory/2376-30-0x0000000074C07000-0x0000000074C08000-memory.dmp

      Filesize

      4KB

    • memory/2728-6-0x0000000000180000-0x000000000018D000-memory.dmp

      Filesize

      52KB

    • memory/2728-18-0x0000000000180000-0x000000000018D000-memory.dmp

      Filesize

      52KB

    • memory/2728-14-0x0000000000180000-0x000000000018D000-memory.dmp

      Filesize

      52KB

    • memory/2728-13-0x000000007714F000-0x0000000077150000-memory.dmp

      Filesize

      4KB

    • memory/2728-35-0x0000000000180000-0x000000000018D000-memory.dmp

      Filesize

      52KB

    • memory/2728-11-0x0000000000180000-0x000000000018D000-memory.dmp

      Filesize

      52KB

    • memory/2728-5-0x0000000000180000-0x000000000018D000-memory.dmp

      Filesize

      52KB