Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 00:29
Static task
static1
Behavioral task
behavioral1
Sample
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe
-
Size
3.2MB
-
MD5
44ee3154f12827d1273221bb3b62fa69
-
SHA1
9c25d06cea35b2395808cb7f47517ac53aebd68f
-
SHA256
5952aad5fe80e49a2bf5657aef45442e565f073a3d71eee7777d81ab34cb2214
-
SHA512
9e1de83ce38353f4aae3c6dfd5cd1fa0a959b8691243d2bf791ef63bb397576af224025984db07d3901b852388c82e2a1e70e7ead7e7166dcacb2a5c5101e359
-
SSDEEP
49152:t84/Z7nq6dHRK7mGnJ6m+ODJZQ4HtJzHDu0i0mSN/UjoUXx+ppxXGG4nmAv:tpQER0skDE8tJzHDuImSNmMWJl
Malware Config
Signatures
-
Detects Echelon Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Crypt.exe family_echelon behavioral1/memory/2724-42-0x0000000001030000-0x00000000011F6000-memory.dmp family_echelon -
Executes dropped EXE 3 IoCs
Processes:
UltraHook newe.sfx.exeUltraHook newe.exeCrypt.exepid process 1280 UltraHook newe.sfx.exe 2384 UltraHook newe.exe 2724 Crypt.exe -
Loads dropped DLL 7 IoCs
Processes:
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exeUltraHook newe.sfx.exepid process 2356 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe 2356 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe 2356 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe 1280 UltraHook newe.sfx.exe 1280 UltraHook newe.sfx.exe 1280 UltraHook newe.sfx.exe 1280 UltraHook newe.sfx.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\UltraHook newe.exe vmprotect behavioral1/memory/2384-36-0x0000000001150000-0x0000000001350000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\Crypt.exe vmprotect behavioral1/memory/2724-42-0x0000000001030000-0x00000000011F6000-memory.dmp vmprotect -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exeUltraHook newe.sfx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UltraHook newe.sfx.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Crypt.exepid process 2724 Crypt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Crypt.exedescription pid process Token: SeDebugPrivilege 2724 Crypt.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exeUltraHook newe.sfx.exeUltraHook newe.exeCrypt.exedescription pid process target process PID 2356 wrote to memory of 1280 2356 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe UltraHook newe.sfx.exe PID 2356 wrote to memory of 1280 2356 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe UltraHook newe.sfx.exe PID 2356 wrote to memory of 1280 2356 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe UltraHook newe.sfx.exe PID 2356 wrote to memory of 1280 2356 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe UltraHook newe.sfx.exe PID 1280 wrote to memory of 2384 1280 UltraHook newe.sfx.exe UltraHook newe.exe PID 1280 wrote to memory of 2384 1280 UltraHook newe.sfx.exe UltraHook newe.exe PID 1280 wrote to memory of 2384 1280 UltraHook newe.sfx.exe UltraHook newe.exe PID 1280 wrote to memory of 2384 1280 UltraHook newe.sfx.exe UltraHook newe.exe PID 2384 wrote to memory of 2724 2384 UltraHook newe.exe Crypt.exe PID 2384 wrote to memory of 2724 2384 UltraHook newe.exe Crypt.exe PID 2384 wrote to memory of 2724 2384 UltraHook newe.exe Crypt.exe PID 2724 wrote to memory of 1260 2724 Crypt.exe WerFault.exe PID 2724 wrote to memory of 1260 2724 Crypt.exe WerFault.exe PID 2724 wrote to memory of 1260 2724 Crypt.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\UltraHook newe.sfx.exe"C:\Users\Admin\AppData\Local\Temp\UltraHook newe.sfx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe"C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\Crypt.exe"C:\Users\Admin\AppData\Local\Temp\Crypt.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2724 -s 9165⤵PID:1260
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD50088abee944713ab183c41f3a2b07ea8
SHA1ea027d6de4b2feebfb35b4ebde88cdaab6d6e744
SHA2568ce4be0ab67c82e4f9023bbea4228430e56ef9ac133d377d75ecf2be75045111
SHA51298c88b5f4d4b30f922fbd219da691842649e7aa39eeac65a8b21ad0bdd9437ace260bdf744910690b3d004fda16f1f267f78c307741526e8ba6bde3558f4c64d
-
Filesize
1.0MB
MD535c69ab07ba4fd97cb23a0351d7293b6
SHA165c3a14d30364f80ebda6cd1b83c6f9633291c35
SHA256f6d38b7dda48f70fabd8cf49cfb5191ef8bb4f351629c06ec102630d852da81c
SHA512072d19611df7a7807a4edff57befe8568132925b493cc7484684b59ef7cee31649eca13adafd3023f0a444241af6e571325880760b534990dfbac6a71bba1a70
-
Filesize
1.3MB
MD506670ce4174643ad43c413115c8fde00
SHA16b7ecb0a6c058d6bd008121478178847bfa59b9b
SHA256af4b0b4e4184e5283032f0b141bd2aac39241624471888061bd6cfe661ff24fc
SHA512ef119712659b877f65310635552898c2518aae66a7e836db5ef699ec52ca21f95e040547f40175a0f9f0329aead206c800d7b6756e78e61321564d45d6ec3dc1