Overview

overview

7

Static

static

1

fea09d8e20...18.exe

windows7-x64

7

fea09d8e20...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    109s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fea09d8e20bf6e09f05b58c4eb181d0e_JaffaCakes118.exe

  • Size

    715KB

  • MD5

    fea09d8e20bf6e09f05b58c4eb181d0e

  • SHA1

    15b08ed1003d3af9f8a7a3648abe6264b3337b2e

  • SHA256

    202f519030f005468713646e338acd7aa1b29f99e7ce77d75c7ec1b7df623f1d

  • SHA512

    81efb0c1670bc955b7eac4afb9d8b9ef84c60ad556bca691ebd7b56c6dc3be084132f287e3f8554255f9618efbaa1fc360ff691c4a6f3b29aa496cbe69c3970f

  • SSDEEP

    12288:hEjxOt0RMMhgMO3ZWRrHhOyoCwAoTw5X0zatOMW7rEyicsGZ8bRs9FmLPn33A:hgk0hHOpsrBOyoCwAoU5X0JMW77BbZUQ

Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fea09d8e20bf6e09f05b58c4eb181d0e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fea09d8e20bf6e09f05b58c4eb181d0e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsz6D65.tmp\FDMClient.dll
    Filesize

    222KB

    MD5

    b8d9503e3c0ac31fae05382a2cc6197b

    SHA1

    f6085be74247af30c2aa79a63e8bd1f9667951df

    SHA256

    e57ec829e42342a1a0826c45a52e76b5cf038d3074f88b64b41dd75a367979c0

    SHA512

    8b926afbd47b42541e51e3eed65eaa7dffab3295d0ee1350174b187995e0d232e2c5b76e426407577c590d6a2418ef12e37bddc15438c1eeaed1e134feda8f6d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsz6D65.tmp\WelcomeScreen.htm
    Filesize

    5KB

    MD5

    54bbb668f02441624af5d536ad9dfd05

    SHA1

    6a4a1e9522658a725c3f4d2864a2087d33368db6

    SHA256

    ed7a47c63626fb0ad11635421592b3e805937ea04a94ca39f6864edceed708fc

    SHA512

    b7cd133b796af24a17345ba578bd03ea1de659f83f7b7d2b29bcf44ccbca376611d35fd0ec435083c8719f2e35cbab2d1afb2d9fdec89a3ef4302fcd715d439c

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsz6D65.tmp\System.dll
    Filesize

    17KB

    MD5

    62008374a494afeea2ee2ae9eee4c8c0

    SHA1

    94808fcf0748c437f4d7ffa4d540e054cb014fab

    SHA256

    9c4affddfa97b268b07c00ac28a2fe617dda806bf55088ccf348da149ee76c1a

    SHA512

    f584ed647b69ff8ff80450be8f0b267ebb3c97826dbf01d078165ea94b43afd1f00fc58b91d9e8f4d78465d70312c1b1a6ac66583ebdc009b0ce471a6cf149a0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsz6D65.tmp\webapphost.dll
    Filesize

    1.4MB

    MD5

    502644b41549622acc7c5116620a22e6

    SHA1

    a7ce72ea70457478f244a3b9e04c5c61e72d6bee

    SHA256

    4653dcd1cd888e0ee00f9f5312523354384f7aa2b3cdd1fd4ebb7a1300faaf51

    SHA512

    cb236405d280e67262202d0f18acb5eee93ad5f0dbcb7207a267f6f8d8efd7042bb73b0f2ce8385c8f066976cc604830184ab645f09f9b930e31ad95c0e977f0

    Download Submit