Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-09-2024 20:31
General
-
Target
fadc761864c9f8819b963a0bdc893357_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
fadc761864c9f8819b963a0bdc893357
-
SHA1
ee8643450535ba5a0ddfe80076241fa0ba10fc53
-
SHA256
08ef6479ea772726db377eb7251bf448877d3c1867242865def381222c5149a8
-
SHA512
712631c50fe0cf61278d194eb30d10f8940b9068dd906d8b3d9cc14b7639123cb8e4dc4bddd9e9ef768c86b0cda066b7886a3961cf9c0bdf69e96a58d985171e
-
SSDEEP
98304:fhEgSFNWFMdWzbWnw1pxFIlVpyOjE6MYTh7KQsRhIxk9:fyBTw1p4onQsfIxk
Malware Config
Extracted
cryptbot
nife01.info
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fadc761864c9f8819b963a0bdc893357_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fadc761864c9f8819b963a0bdc893357_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Unicodek\Unius.exeC:\ProgramData\Unicodek\Unius.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\ipras.vbs"2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5c672c5ffd1a94b729484cc279d2a8a93
SHA13e3ce8ad41d3ffe36d461a21ded8fead5d11e88b
SHA256087e2c68049f6d81393d62c9fbca232111ec9e0411f5cc9ab1e718475581eaea
SHA512969821c1ea8ae7b400e0e603326a3eb76ad22c21572a12b34e50f97f174f53456e937872c1a5980f7401d702c56c00ec0c5fa4d9cdc38b7d2c6200037f12aae3
-
Filesize
47KB
MD511c2715b17d83ae8da83658c96fbffb8
SHA19acb8348d4e2267b8b7097e6090821c9628f535c
SHA2567db699662ffe63924e902ab1000b5f810403a7c55956dd1cb9699692bf85b3e3
SHA5128b99607c931bb59b6a183717667c4f9cfc667acdce7bfed4e971eb9b9aec2a39d7db86b685ffd31be326cc0633ac7b1254439f2591560fa2935b17f3a3c71507
-
Filesize
3B
MD5ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA157218c316b6921e2cd61027a2387edc31a2d9471
SHA256f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
SHA51237c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
-
Filesize
1KB
MD5a6d4fbd2214963f0a44d260e2225a0d7
SHA1c457e19e944dec38d0aeac5d485d93ad5765c773
SHA2565380ef9e73abda238d4fe6344e7a08b106d981f57a3016cae619956e4b748571
SHA5127d28b8f25272e2fc1db07f82d89c296d551f4c5de08d54c8e4ee218535849966e2efbdea6cf0f9a8226840936e1cbf7de7a3c724cf51947d585ff284bcf04b2e
-
Filesize
126B
MD5c6362e3c5585f24a9e9a2712c00c52ff
SHA19259b9609313386f004328d2c306820eae01a587
SHA256184ca5b2737175e0828f3546d483778c95e23720f1375deac0090c2fe415e208
SHA51259ac94fdb6f41d6dc5cbea1855897759f35032ac922b936a0b39a21b6aafb0c862c5d419afa31c0b81f106f2ce06b2909cdb5fb713534fbe36202c5a4fedfeaa
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
174B
MD593513a629a7c8aad8bc873c9447d158e
SHA109ca1c8ed380a1956f00d2422819c4c9be411175
SHA256e4a75a4fe883822b3a664a5f8f521a2618276a60b8f033b542e1f7c26ce4b8dc
SHA51226fc50319e4279318d19ea3f163002a5ff01e2e30c37cd66a3b584257a582cf78586f1282f15fea686686e791dbb517a6052c3a2efcf6dd71fa7e492ebc33081
-
Filesize
170B
MD5ff414092a15486e355127ea2b482a849
SHA1198b1705ddac4d20e1e811c26c03d610e0da1af8
SHA256cf3b54591489fedc733a67b9f04f5760dafcff76cc3df9f84bcfaed835b71441
SHA51253a7690d470890314e05c9f63cab7fe46b27f702686929b11116548365ad4d859bc9323bac975a2cab6d36ac83d94c36159042374d3914b90d7884bed0fa9f1e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
2.2MB
MD5da4cba039da84811abbe2d7b73efa488
SHA15eaabd7ed6d1552dcdec225ecd7d8a8d4e7c43b2
SHA256f852161c46e2b5edd38cd552562afc7a5d14435d1a6a373a87ca18df2ebc76c6
SHA5128d2569fed7a67e54938b665359ab7476c24369fe8f95b3fbad51c0ef787300131db3340d4ff712f857473807da975980a38e1ce303bd48bf41b4ec4086e6ffa5
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
4KB
-
Filesize
5.3MB
-
Filesize
7.3MB
-
Filesize
4KB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
368KB
-
Filesize
5.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
8KB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
4KB
-
Filesize
5.3MB
-
Filesize
4KB
-
Filesize
5.3MB
-
Filesize
4KB
-
Filesize
5.3MB
-
Filesize
4KB
-
Filesize
5.3MB
-
Filesize
392KB
-
Filesize
5.3MB
-
Filesize
5.3MB