Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2024 00:29
Static task
static1
Behavioral task
behavioral1
Sample
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe
-
Size
3.2MB
-
MD5
44ee3154f12827d1273221bb3b62fa69
-
SHA1
9c25d06cea35b2395808cb7f47517ac53aebd68f
-
SHA256
5952aad5fe80e49a2bf5657aef45442e565f073a3d71eee7777d81ab34cb2214
-
SHA512
9e1de83ce38353f4aae3c6dfd5cd1fa0a959b8691243d2bf791ef63bb397576af224025984db07d3901b852388c82e2a1e70e7ead7e7166dcacb2a5c5101e359
-
SSDEEP
49152:t84/Z7nq6dHRK7mGnJ6m+ODJZQ4HtJzHDu0i0mSN/UjoUXx+ppxXGG4nmAv:tpQER0skDE8tJzHDuImSNmMWJl
Malware Config
Signatures
-
Detects Echelon Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Crypt.exe family_echelon behavioral2/memory/1828-38-0x00000226D6F30000-0x00000226D70F6000-memory.dmp family_echelon -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exeUltraHook newe.sfx.exeUltraHook newe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation UltraHook newe.sfx.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation UltraHook newe.exe -
Executes dropped EXE 3 IoCs
Processes:
UltraHook newe.sfx.exeUltraHook newe.exeCrypt.exepid process 1660 UltraHook newe.sfx.exe 4836 UltraHook newe.exe 1828 Crypt.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe vmprotect behavioral2/memory/4836-25-0x0000000000B00000-0x0000000000D00000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\Crypt.exe vmprotect behavioral2/memory/1828-38-0x00000226D6F30000-0x00000226D70F6000-memory.dmp vmprotect -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exeUltraHook newe.sfx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UltraHook newe.sfx.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Crypt.exepid process 1828 Crypt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Crypt.exedescription pid process Token: SeDebugPrivilege 1828 Crypt.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exeUltraHook newe.sfx.exeUltraHook newe.exedescription pid process target process PID 4016 wrote to memory of 1660 4016 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe UltraHook newe.sfx.exe PID 4016 wrote to memory of 1660 4016 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe UltraHook newe.sfx.exe PID 4016 wrote to memory of 1660 4016 44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe UltraHook newe.sfx.exe PID 1660 wrote to memory of 4836 1660 UltraHook newe.sfx.exe UltraHook newe.exe PID 1660 wrote to memory of 4836 1660 UltraHook newe.sfx.exe UltraHook newe.exe PID 4836 wrote to memory of 1828 4836 UltraHook newe.exe Crypt.exe PID 4836 wrote to memory of 1828 4836 UltraHook newe.exe Crypt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\44ee3154f12827d1273221bb3b62fa69_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\UltraHook newe.sfx.exe"C:\Users\Admin\AppData\Local\Temp\UltraHook newe.sfx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe"C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\Crypt.exe"C:\Users\Admin\AppData\Local\Temp\Crypt.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD50088abee944713ab183c41f3a2b07ea8
SHA1ea027d6de4b2feebfb35b4ebde88cdaab6d6e744
SHA2568ce4be0ab67c82e4f9023bbea4228430e56ef9ac133d377d75ecf2be75045111
SHA51298c88b5f4d4b30f922fbd219da691842649e7aa39eeac65a8b21ad0bdd9437ace260bdf744910690b3d004fda16f1f267f78c307741526e8ba6bde3558f4c64d
-
Filesize
1.0MB
MD535c69ab07ba4fd97cb23a0351d7293b6
SHA165c3a14d30364f80ebda6cd1b83c6f9633291c35
SHA256f6d38b7dda48f70fabd8cf49cfb5191ef8bb4f351629c06ec102630d852da81c
SHA512072d19611df7a7807a4edff57befe8568132925b493cc7484684b59ef7cee31649eca13adafd3023f0a444241af6e571325880760b534990dfbac6a71bba1a70
-
Filesize
1.3MB
MD506670ce4174643ad43c413115c8fde00
SHA16b7ecb0a6c058d6bd008121478178847bfa59b9b
SHA256af4b0b4e4184e5283032f0b141bd2aac39241624471888061bd6cfe661ff24fc
SHA512ef119712659b877f65310635552898c2518aae66a7e836db5ef699ec52ca21f95e040547f40175a0f9f0329aead206c800d7b6756e78e61321564d45d6ec3dc1