Analysis
-
max time kernel
93s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 00:23
Static task
static1
Behavioral task
behavioral1
Sample
ea3f34c247aab89606489d062b246697_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ea3f34c247aab89606489d062b246697_JaffaCakes118.exe
-
Size
774KB
-
MD5
ea3f34c247aab89606489d062b246697
-
SHA1
48c2b2f2f8cf518793533a7b588657ccf4302df7
-
SHA256
8d721ae4f0e9bc45b9ed943d41d59ffc522fa7ffe624a562791997924c7f51fd
-
SHA512
34558da96f3bcf6d0b29903403ffd611362fc7bebf29b4471ba8b693318a8c3c1e4650a738e3bf00879d4674b0b889d8bd4a03e86fc0771710bf304de3098c20
-
SSDEEP
12288:z3a+H1dtXSOngM/CF39utpqZ3qdUiPPBDoAj3kob:zq+xigD/CF39uvqNqdjPPCARb
Malware Config
Signatures
-
Taurus Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/412-6-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/412-9-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/412-8-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/412-11-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/412-12-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exedescription pid process target process PID 3116 set thread context of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exeAddInProcess32.execmd.exetimeout.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea3f34c247aab89606489d062b246697_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4300 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ea3f34c247aab89606489d062b246697_JaffaCakes118.exeAddInProcess32.execmd.exedescription pid process target process PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 3116 wrote to memory of 412 3116 ea3f34c247aab89606489d062b246697_JaffaCakes118.exe AddInProcess32.exe PID 412 wrote to memory of 2700 412 AddInProcess32.exe cmd.exe PID 412 wrote to memory of 2700 412 AddInProcess32.exe cmd.exe PID 412 wrote to memory of 2700 412 AddInProcess32.exe cmd.exe PID 2700 wrote to memory of 4300 2700 cmd.exe timeout.exe PID 2700 wrote to memory of 4300 2700 cmd.exe timeout.exe PID 2700 wrote to memory of 4300 2700 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea3f34c247aab89606489d062b246697_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea3f34c247aab89606489d062b246697_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\timeout.exetimeout /t 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4300
-
-
-