Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 12:07

General

  • Target

    cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe

  • Size

    220KB

  • MD5

    cf7e798677be88a8d57f1a70b08c51ac

  • SHA1

    127bb8d556878e51d2ff532aa9fb2a025038a087

  • SHA256

    4ce532ca66f52be999e1ae651a14245d00c70deaab4ef89fc2788c50c0ff0621

  • SHA512

    6260873f5d4a4f4c0d159c79a52f0eda0a856c880189398e86d83ef8db4e9774ef006257d9716640cbb16f71ea8230cef6386993dc739567277a2598710834c9

  • SSDEEP

    3072:DOLZB4qxV8LfZnsveixlaLqaMa/kX4JrBwPfCf2VIoIIfwUM2TUF:yLZB4UV8hsTxlaLHMQkXIrBVf6xP0

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\cf7e798677be88a8d57f1a70b08c51ac_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\Recycle.Bin\B6232F3A620.exe
        "C:\Recycle.Bin\B6232F3A620.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Recycle.Bin\B6232F3A620.exe
          "C:\Recycle.Bin\B6232F3A620.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3068
          • C:\Users\Admin\AppData\Local\Temp\9I69C40.exe
            "C:\Users\Admin\AppData\Local\Temp\9I69C40.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\4D99B8ECDBD1BA6

    Filesize

    4KB

    MD5

    8e8ecd5b98d5b1120fa611c06b864f5f

    SHA1

    239f2aff03002b5b604310fe8949be15da65bc30

    SHA256

    6b43d03e0a39957461deba724c38ab63484bd48d818aad087f00e10268aa4a9e

    SHA512

    02156e9d68eee579a4f1463ea525a5be13b7242ee9d34ca340a215a998830e5e087eed5a35609e7c885d64c4835b021b514d86151cf0ae12f8388be5443e1410

  • C:\Recycle.Bin\B6232F3A620.exe

    Filesize

    220KB

    MD5

    cf7e798677be88a8d57f1a70b08c51ac

    SHA1

    127bb8d556878e51d2ff532aa9fb2a025038a087

    SHA256

    4ce532ca66f52be999e1ae651a14245d00c70deaab4ef89fc2788c50c0ff0621

    SHA512

    6260873f5d4a4f4c0d159c79a52f0eda0a856c880189398e86d83ef8db4e9774ef006257d9716640cbb16f71ea8230cef6386993dc739567277a2598710834c9

  • C:\Users\Admin\AppData\Local\Temp\9I69C40.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • memory/1452-35-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2620-0-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2620-14-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/3068-39-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/3068-32-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/3068-33-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/3068-34-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/3868-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-75-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-128-0x0000000075350000-0x00000000757A0000-memory.dmp

    Filesize

    4.3MB

  • memory/3868-127-0x0000000075350000-0x00000000757A0000-memory.dmp

    Filesize

    4.3MB

  • memory/3868-126-0x0000000075350000-0x00000000757A0000-memory.dmp

    Filesize

    4.3MB

  • memory/3868-125-0x0000000075350000-0x00000000757A0000-memory.dmp

    Filesize

    4.3MB

  • memory/3868-51-0x00000000008E0000-0x000000000092E000-memory.dmp

    Filesize

    312KB

  • memory/3868-53-0x00000000008E0000-0x000000000092E000-memory.dmp

    Filesize

    312KB

  • memory/3868-55-0x0000000000460000-0x0000000000465000-memory.dmp

    Filesize

    20KB

  • memory/3868-41-0x00000000008E0000-0x000000000092E000-memory.dmp

    Filesize

    312KB

  • memory/3868-60-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-49-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/3868-48-0x0000000001001000-0x0000000001002000-memory.dmp

    Filesize

    4KB

  • memory/3868-47-0x00000000008E0000-0x000000000092E000-memory.dmp

    Filesize

    312KB

  • memory/3868-50-0x00000000008E0000-0x000000000092E000-memory.dmp

    Filesize

    312KB

  • memory/3868-117-0x0000000075350000-0x00000000757A0000-memory.dmp

    Filesize

    4.3MB

  • memory/3868-54-0x00000000008E0000-0x000000000092E000-memory.dmp

    Filesize

    312KB

  • memory/3868-56-0x00000000008E0000-0x000000000092E000-memory.dmp

    Filesize

    312KB

  • memory/3868-59-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-66-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-65-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-64-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-84-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-82-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-94-0x0000000075608000-0x000000007560A000-memory.dmp

    Filesize

    8KB

  • memory/3868-79-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-78-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-77-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-76-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-61-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-74-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-73-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-72-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-71-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-70-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-69-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-68-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-67-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-63-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/3868-62-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/5056-5-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-87-0x0000000077C72000-0x0000000077C74000-memory.dmp

    Filesize

    8KB

  • memory/5056-86-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/5056-16-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/5056-3-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-97-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/5056-95-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/5056-93-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/5056-91-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/5056-92-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/5056-7-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-96-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/5056-88-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/5056-13-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-12-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-10-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-9-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-6-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/5056-15-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/5056-19-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB