Analysis
-
max time kernel
94s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 23:42
General
-
Target
d7488d904f5e9ff786bde969c68b9c72_JaffaCakes118.exe
-
Size
154KB
-
MD5
d7488d904f5e9ff786bde969c68b9c72
-
SHA1
3c6cce8aaa55b1715cf8188e49684c0cde89297b
-
SHA256
639f06203eb816f2b4ca16d8ad0cc22cb5b2954b39dd47d259b5cbd7985413b1
-
SHA512
4e41585fd9c11ce0557522dc47a3459fe91558d028e3885c0193a6f3a42afab7fbdb5b1b163e084efb4abadf14277e03b1fd18f4eaa2ad106865e5b07c32310e
-
SSDEEP
3072:DrAVguiZxHF02SOacgAf+9mzB7y7YRguXt:DWgVZ1vGAfL1X
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7488d904f5e9ff786bde969c68b9c72_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d7488d904f5e9ff786bde969c68b9c72_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\upd88B8.tmp"C:\Users\Admin\AppData\Local\Temp\upd88B8.tmp" --bpl="eyJpbnN0YWxsX3VybCI6ICJodHRwczovL2dvc29mdGRsLm1haWwucnUvc3dpdGNoZXJfcGRfM185LmV4ZSIsICJjb21tYW5kX2xpbmUiOiAiIiwgInRzIjogMTU0NTA2NzIwMiwgImNsaV92ZXIiOiAyLCAicXVlcnlfc3RyaW5nIjogInBhcnRuZXJpZD03ODkyNjMmdWFfcmZyPTEyOTczXzc4OTI2MyZhbV9kZWZhdWx0PTEmYW1pZ29faW5zdGFsbD0xJnBhcnRuZXJfbmV3X3VybD1odHRwJTNBJTJGJTJGc2V0c3RhdC5ydSUyRmFwaSUyRnNhdmVQb3N0YmFjayUzRnRva2VuJTNEWndxcndHZ2RDRCUyNnR5cGUlM0RyX25ld19ydS5leGUiLCAibG9jYXRpb25faWQiOiAibGFuZF9wYXJ0bmVyIn0="2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38B
MD529ffbdc872016fd1866821f55d0e6f4d
SHA1ae918dbbd837bfdf9a74db907abe15fdd5f97798
SHA256584d681a28c23ccd5b27b3e719f31c4cb2619d7bad2ce42e55dc985b8fcd8817
SHA51291c46d142204adc14a552d6278964826db5ba97721ae63706b9c7b2ebaef47a6bbbe03404d181da940e664c34413e51e87d194b73c45f8682a9647c9ae1ffca5
-
Filesize
1.9MB
MD559ec4314e2a54053778d3862368d639c
SHA1a6e7e4383d2a49460f90f46d81bf31260fb71a50
SHA2568dca302c817de6eab1783ed87139cbe2c0da2be2ccc077cabac12ac3237dab91
SHA51248ec36e24c66df5951a35ff366aa80b70aef005119438e1a97dcc81b21e726a4f1eb7e9000026a75811e1fd7ef51255df28647b30140d136af223acf4e968834