Analysis

  • max time kernel
    52s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 12:11

General

  • Target

    f39c9a2e23e3f3119efe4698d26b9f53_JaffaCakes118.exe

  • Size

    140KB

  • MD5

    f39c9a2e23e3f3119efe4698d26b9f53

  • SHA1

    def8046d2bd2da6a2d40061454400d6ce5c5d4af

  • SHA256

    a2228653372c172284e73ccc2ea18b4634eae8a9c352a2fca22c33131bbf8618

  • SHA512

    8ffe5de645e4357139fb1987b31c04542c646442212ad80d090bd20155c35008c9e847e83072a164f5ca1481881f4a36ff651eb35d3716e519ee608cbcdceae5

  • SSDEEP

    1536:xxwQevvSjfQ2QOE/baP/8bUxwYgv16oxgyKELV5ANMz/9NEjT8NjOO8k:PiYOBTanXgvvKELVBYjT8z8k

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f39c9a2e23e3f3119efe4698d26b9f53_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f39c9a2e23e3f3119efe4698d26b9f53_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\AppData\Roaming\dvd.exe
      C:\Users\Admin\AppData\Roaming\dvd.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\dvd.exe

    Filesize

    1KB

    MD5

    9ac8e81c1613f020a1c199effb9a1195

    SHA1

    9874e0e1ab6e4c28fe6645385a814e05302a652a

    SHA256

    4c74e3f2efb3f9c7dc5ec57a030ade70aad5457a92fb2dfe464738fa6d1cf651

    SHA512

    9a8020b5dba56f5fdf61b6377a1fe819121f063717b4f16d2f77151337d2bb6f6a149082e072292e16499a9852a08fac71e2076ce1175cd72ee524e22da293eb

  • memory/1332-6-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1332-11-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1332-15-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1332-16-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4188-0-0x00000000749D2000-0x00000000749D3000-memory.dmp

    Filesize

    4KB

  • memory/4188-1-0x00000000749D0000-0x0000000074F81000-memory.dmp

    Filesize

    5.7MB

  • memory/4188-2-0x00000000749D0000-0x0000000074F81000-memory.dmp

    Filesize

    5.7MB

  • memory/4188-14-0x00000000749D0000-0x0000000074F81000-memory.dmp

    Filesize

    5.7MB