Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 00:23
Static task
static1
Behavioral task
behavioral1
Sample
ea3f34c247aab89606489d062b246697_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ea3f34c247aab89606489d062b246697_JaffaCakes118.exe
-
Size
774KB
-
MD5
ea3f34c247aab89606489d062b246697
-
SHA1
48c2b2f2f8cf518793533a7b588657ccf4302df7
-
SHA256
8d721ae4f0e9bc45b9ed943d41d59ffc522fa7ffe624a562791997924c7f51fd
-
SHA512
34558da96f3bcf6d0b29903403ffd611362fc7bebf29b4471ba8b693318a8c3c1e4650a738e3bf00879d4674b0b889d8bd4a03e86fc0771710bf304de3098c20
-
SSDEEP
12288:z3a+H1dtXSOngM/CF39utpqZ3qdUiPPBDoAj3kob:zq+xigD/CF39uvqNqdjPPCARb
Malware Config
Signatures
-
Taurus Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2620-8-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2620-6-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2620-10-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2620-11-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2620-12-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exedescription pid Process procid_target PID 2792 set thread context of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exeAddInProcess32.execmd.exetimeout.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea3f34c247aab89606489d062b246697_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 2428 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exedescription pid Process Token: SeDebugPrivilege 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exeAddInProcess32.execmd.exedescription pid Process procid_target PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2620 2792 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe 30 PID 2620 wrote to memory of 532 2620 AddInProcess32.exe 35 PID 2620 wrote to memory of 532 2620 AddInProcess32.exe 35 PID 2620 wrote to memory of 532 2620 AddInProcess32.exe 35 PID 2620 wrote to memory of 532 2620 AddInProcess32.exe 35 PID 532 wrote to memory of 2428 532 cmd.exe 37 PID 532 wrote to memory of 2428 532 cmd.exe 37 PID 532 wrote to memory of 2428 532 cmd.exe 37 PID 532 wrote to memory of 2428 532 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea3f34c247aab89606489d062b246697_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea3f34c247aab89606489d062b246697_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\timeout.exetimeout /t 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2428
-
-
-