Overview

overview

7

Static

static

3

eab4224a91...18.exe

windows7-x64

7

eab4224a91...18.exe

windows10-2004-x64

7

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...ed.htm

windows7-x64

3

$PLUGINSDI...ed.htm

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ss.htm

windows7-x64

3

$PLUGINSDI...ss.htm

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ss.htm

windows7-x64

3

$PLUGINSDI...ss.htm

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...en.htm

windows7-x64

3

$PLUGINSDI...en.htm

windows10-2004-x64

1

$PLUGINSDI...t.html

windows7-x64

3

$PLUGINSDI...t.html

windows10-2004-x64

3

$PLUGINSDI...r.html

windows7-x64

3

$PLUGINSDI...r.html

windows10-2004-x64

3

$PLUGINSDI...ed.exe

windows7-x64

3

$PLUGINSDI...ed.exe

windows10-2004-x64

3

$PLUGINSDI...lay.js

windows7-x64

3

$PLUGINSDI...lay.js

windows10-2004-x64

3

$PLUGINSDI...min.js

windows7-x64

3

$PLUGINSDI...min.js

windows10-2004-x64

3

$PLUGINSDI...ger.js

windows7-x64

3

$PLUGINSDI...ger.js

windows10-2004-x64

3

$PLUGINSDI...ker.js

windows7-x64

3

$PLUGINSDI...ker.js

windows10-2004-x64

3

Analysis

  • max time kernel
    93s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 05:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eab4224a915b61070a26486434011586_JaffaCakes118.exe

  • Size

    809KB

  • MD5

    eab4224a915b61070a26486434011586

  • SHA1

    a4c426072b4b2307261a58960f1ce52506db37a0

  • SHA256

    20cb81dee086f39aca1b60dcf082297b77ceae9979478d056da7324db9215f2a

  • SHA512

    0d69db6a37016b1b3d9a3a8b62391846dcc7e89616d7418d362363d048a865ebde3fad7fd7989fe58bdf71b45e32222561007d3e0b80fc895e17da7a4cb204f1

  • SSDEEP

    24576:z+B9nGDOTcVKtrQjUFqVhPbwrirJhOLWyRR:yB9GDOWKBl8hDLJO

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eab4224a915b61070a26486434011586_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eab4224a915b61070a26486434011586_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4324
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 3556
      2⤵
      • Program crash
      PID:2708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4324 -ip 4324
    1⤵
      PID:2008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsi66EA.tmp\FDMClient.dll
      Filesize

      222KB

      MD5

      b8d9503e3c0ac31fae05382a2cc6197b

      SHA1

      f6085be74247af30c2aa79a63e8bd1f9667951df

      SHA256

      e57ec829e42342a1a0826c45a52e76b5cf038d3074f88b64b41dd75a367979c0

      SHA512

      8b926afbd47b42541e51e3eed65eaa7dffab3295d0ee1350174b187995e0d232e2c5b76e426407577c590d6a2418ef12e37bddc15438c1eeaed1e134feda8f6d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsi66EA.tmp\System.dll
      Filesize

      17KB

      MD5

      62008374a494afeea2ee2ae9eee4c8c0

      SHA1

      94808fcf0748c437f4d7ffa4d540e054cb014fab

      SHA256

      9c4affddfa97b268b07c00ac28a2fe617dda806bf55088ccf348da149ee76c1a

      SHA512

      f584ed647b69ff8ff80450be8f0b267ebb3c97826dbf01d078165ea94b43afd1f00fc58b91d9e8f4d78465d70312c1b1a6ac66583ebdc009b0ce471a6cf149a0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsi66EA.tmp\webapphost.dll
      Filesize

      1.4MB

      MD5

      502644b41549622acc7c5116620a22e6

      SHA1

      a7ce72ea70457478f244a3b9e04c5c61e72d6bee

      SHA256

      4653dcd1cd888e0ee00f9f5312523354384f7aa2b3cdd1fd4ebb7a1300faaf51

      SHA512

      cb236405d280e67262202d0f18acb5eee93ad5f0dbcb7207a267f6f8d8efd7042bb73b0f2ce8385c8f066976cc604830184ab645f09f9b930e31ad95c0e977f0

      Download Submit