Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 12:07

General

  • Target

    cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe

  • Size

    220KB

  • MD5

    cf7e798677be88a8d57f1a70b08c51ac

  • SHA1

    127bb8d556878e51d2ff532aa9fb2a025038a087

  • SHA256

    4ce532ca66f52be999e1ae651a14245d00c70deaab4ef89fc2788c50c0ff0621

  • SHA512

    6260873f5d4a4f4c0d159c79a52f0eda0a856c880189398e86d83ef8db4e9774ef006257d9716640cbb16f71ea8230cef6386993dc739567277a2598710834c9

  • SSDEEP

    3072:DOLZB4qxV8LfZnsveixlaLqaMa/kX4JrBwPfCf2VIoIIfwUM2TUF:yLZB4UV8hsTxlaLHMQkXIrBVf6xP0

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Recycle.Bin\B6232F3ACDF.exe
        "C:\Recycle.Bin\B6232F3ACDF.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Recycle.Bin\B6232F3ACDF.exe
          "C:\Recycle.Bin\B6232F3ACDF.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\Users\Admin\AppData\Local\Temp\YhW9E04.exe
            "C:\Users\Admin\AppData\Local\Temp\YhW9E04.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\E05AA4E37459B2C

    Filesize

    4KB

    MD5

    8e8ecd5b98d5b1120fa611c06b864f5f

    SHA1

    239f2aff03002b5b604310fe8949be15da65bc30

    SHA256

    6b43d03e0a39957461deba724c38ab63484bd48d818aad087f00e10268aa4a9e

    SHA512

    02156e9d68eee579a4f1463ea525a5be13b7242ee9d34ca340a215a998830e5e087eed5a35609e7c885d64c4835b021b514d86151cf0ae12f8388be5443e1410

  • \Recycle.Bin\B6232F3ACDF.exe

    Filesize

    220KB

    MD5

    cf7e798677be88a8d57f1a70b08c51ac

    SHA1

    127bb8d556878e51d2ff532aa9fb2a025038a087

    SHA256

    4ce532ca66f52be999e1ae651a14245d00c70deaab4ef89fc2788c50c0ff0621

    SHA512

    6260873f5d4a4f4c0d159c79a52f0eda0a856c880189398e86d83ef8db4e9774ef006257d9716640cbb16f71ea8230cef6386993dc739567277a2598710834c9

  • \Users\Admin\AppData\Local\Temp\YhW9E04.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • memory/1260-60-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2108-12-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2108-0-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2324-105-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-108-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-164-0x0000000074C84000-0x0000000074C86000-memory.dmp

    Filesize

    8KB

  • memory/2324-114-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-113-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-112-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-111-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-110-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-109-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-83-0x0000000001001000-0x0000000001002000-memory.dmp

    Filesize

    4KB

  • memory/2324-84-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/2324-99-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-102-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-103-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-106-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-76-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2324-107-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2324-100-0x0000000000370000-0x0000000000375000-memory.dmp

    Filesize

    20KB

  • memory/2324-91-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2324-89-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2324-87-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2324-88-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2324-92-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2324-104-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2404-28-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2404-26-0x000000007708F000-0x0000000077091000-memory.dmp

    Filesize

    8KB

  • memory/2404-19-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-6-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-20-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2404-130-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2404-46-0x000000000048E000-0x000000000048F000-memory.dmp

    Filesize

    4KB

  • memory/2404-43-0x000000000048E000-0x000000000048F000-memory.dmp

    Filesize

    4KB

  • memory/2404-44-0x000000000048E000-0x000000000048F000-memory.dmp

    Filesize

    4KB

  • memory/2404-5-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-45-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2404-37-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/2404-38-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/2404-86-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/2404-39-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-11-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-128-0x000000007708F000-0x0000000077091000-memory.dmp

    Filesize

    8KB

  • memory/2404-9-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-3-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-18-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-25-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2404-22-0x000000007708F000-0x0000000077091000-memory.dmp

    Filesize

    8KB

  • memory/2404-23-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2404-85-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/2404-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2404-21-0x000000000048E000-0x000000000048F000-memory.dmp

    Filesize

    4KB

  • memory/2404-13-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-14-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-15-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-16-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2404-17-0x000000000048E000-0x000000000048F000-memory.dmp

    Filesize

    4KB

  • memory/2860-82-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2860-65-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2860-61-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2860-69-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB