20cb81dee086f39aca1b60dcf082297b77ceae9979478d056da7324db9215f2a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab4224a915b61070a26486434011586_JaffaCakes118.exe
Size

809KB
MD5

eab4224a915b61070a26486434011586
SHA1

a4c426072b4b2307261a58960f1ce52506db37a0
SHA256

20cb81dee086f39aca1b60dcf082297b77ceae9979478d056da7324db9215f2a
SHA512

0d69db6a37016b1b3d9a3a8b62391846dcc7e89616d7418d362363d048a865ebde3fad7fd7989fe58bdf71b45e32222561007d3e0b80fc895e17da7a4cb204f1
SSDEEP

24576:z+B9nGDOTcVKtrQjUFqVhPbwrirJhOLWyRR:yB9GDOWKBl8hDLJO

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab4224a915b61070a26486434011586_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	eab4224a915b61070a26486434011586_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\eab4224a915b61070a26486434011586_JaffaCakes118.exe = "11000"	eab4224a915b61070a26486434011586_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WebBrowser_embedded.exe = "11000"	eab4224a915b61070a26486434011586_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	eab4224a915b61070a26486434011586_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	eab4224a915b61070a26486434011586_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	eab4224a915b61070a26486434011586_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	eab4224a915b61070a26486434011586_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe
2416	eab4224a915b61070a26486434011586_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eab4224a915b61070a26486434011586_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eab4224a915b61070a26486434011586_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy560E.tmp\WelcomeScreen.htm

Filesize
5KB

MD5
54bbb668f02441624af5d536ad9dfd05

SHA1
6a4a1e9522658a725c3f4d2864a2087d33368db6

SHA256
ed7a47c63626fb0ad11635421592b3e805937ea04a94ca39f6864edceed708fc

SHA512
b7cd133b796af24a17345ba578bd03ea1de659f83f7b7d2b29bcf44ccbca376611d35fd0ec435083c8719f2e35cbab2d1afb2d9fdec89a3ef4302fcd715d439c

Download Submit
\Users\Admin\AppData\Local\Temp\nsy560E.tmp\FDMClient.dll

Filesize
222KB

MD5
b8d9503e3c0ac31fae05382a2cc6197b

SHA1
f6085be74247af30c2aa79a63e8bd1f9667951df

SHA256
e57ec829e42342a1a0826c45a52e76b5cf038d3074f88b64b41dd75a367979c0

SHA512
8b926afbd47b42541e51e3eed65eaa7dffab3295d0ee1350174b187995e0d232e2c5b76e426407577c590d6a2418ef12e37bddc15438c1eeaed1e134feda8f6d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy560E.tmp\System.dll

Filesize
17KB

MD5
62008374a494afeea2ee2ae9eee4c8c0

SHA1
94808fcf0748c437f4d7ffa4d540e054cb014fab

SHA256
9c4affddfa97b268b07c00ac28a2fe617dda806bf55088ccf348da149ee76c1a

SHA512
f584ed647b69ff8ff80450be8f0b267ebb3c97826dbf01d078165ea94b43afd1f00fc58b91d9e8f4d78465d70312c1b1a6ac66583ebdc009b0ce471a6cf149a0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy560E.tmp\webapphost.dll

Filesize
1.4MB

MD5
502644b41549622acc7c5116620a22e6

SHA1
a7ce72ea70457478f244a3b9e04c5c61e72d6bee

SHA256
4653dcd1cd888e0ee00f9f5312523354384f7aa2b3cdd1fd4ebb7a1300faaf51

SHA512
cb236405d280e67262202d0f18acb5eee93ad5f0dbcb7207a267f6f8d8efd7042bb73b0f2ce8385c8f066976cc604830184ab645f09f9b930e31ad95c0e977f0

Download Submit