Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 00:04

General

  • Target

    4fc1e30a4888ba22af0b315fe3fe0787_JaffaCakes118.exe

  • Size

    830KB

  • MD5

    4fc1e30a4888ba22af0b315fe3fe0787

  • SHA1

    76432e3c293a479e43ca3a996b0be963333a6aba

  • SHA256

    6d907f1ea22ca8f81d3259baf20b0db7dd1e0bdfa591a0529622326bccd8ba03

  • SHA512

    ca793fa294adeba25275dd5907a1c74ffc22b59df7aecc15b1bfa83bb2f88529ac581be736db3e5c14fbc3bf897ab70f32845a00a8f67a24725b99d8ae789a76

  • SSDEEP

    24576:TlZYhGV8zpOrAe1ETenGblx3JG/yHJpijbUcWrmb:TlZmGy8rAe1ETeyTJHHJpij

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fc1e30a4888ba22af0b315fe3fe0787_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4fc1e30a4888ba22af0b315fe3fe0787_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\ProgramData\privacy.exe
      C:\ProgramData\privacy.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2516

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \ProgramData\privacy.exe

          Filesize

          807KB

          MD5

          97708f4fc871aa424234fb56d11a227d

          SHA1

          683f6b33d2fbf333f046ccf8a53843f8485efab8

          SHA256

          e66e99953ca14bf0c69dd842cc929ba5cc5a0cf46b2d5fd971235586008ce52c

          SHA512

          e5f7b0e40b4e7a80531ded2a2d5e8e4f8182707e144977a335d1e16aed7ae3ca767d53286e73a300e60151d7e8f534a3a5eb4f56d4067bdba314c449e8c44b52

        • memory/1260-24-0x0000000000400000-0x00000000004DC000-memory.dmp

          Filesize

          880KB

        • memory/1260-0-0x0000000002770000-0x0000000002778000-memory.dmp

          Filesize

          32KB

        • memory/1260-4-0x0000000077E80000-0x0000000077E81000-memory.dmp

          Filesize

          4KB

        • memory/1260-1-0x0000000000400000-0x00000000004DC000-memory.dmp

          Filesize

          880KB

        • memory/2516-27-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-32-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-21-0x00000000009F1000-0x00000000009F2000-memory.dmp

          Filesize

          4KB

        • memory/2516-23-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-19-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-25-0x0000000002780000-0x0000000002788000-memory.dmp

          Filesize

          32KB

        • memory/2516-26-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-18-0x0000000002780000-0x0000000002788000-memory.dmp

          Filesize

          32KB

        • memory/2516-28-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-29-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-30-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-22-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-33-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-34-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-35-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-36-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-37-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-38-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-39-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-40-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-41-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB

        • memory/2516-42-0x0000000000400000-0x0000000000A0E000-memory.dmp

          Filesize

          6.1MB