Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
6512ee54cb87daf804d1d337785c947e
-
SHA1
6e29351ed23c4b14d731a36c789e08cea5f8eb5e
-
SHA256
fe2a40f78f2acb54fb1675bbe256de830d9c78ff813818d7335b98ce8b2bb3e6
-
SHA512
a7725fee1f1a90fe6b0571cf293b028f4128ac5baf62f64cc3b6ba20d7c412437918096c86b005411bb922b42f020c393980965f0ec7c16b000a8e0773da96b7
-
SSDEEP
24576:+DWHSb4Nc0yPFtkTb67tzzM9DvVIJV1rliDpL9Dh7qd2P69EuKA+R:t846kKzzKVIJ5+pLTpP699Kn
Malware Config
Signatures
-
Detects Echelon Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Crypt.exe family_echelon behavioral2/memory/3932-34-0x000001CDF61E0000-0x000001CDF63A6000-memory.dmp family_echelon -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exeUltraHook newe.sfx.exeUltraHook newe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation UltraHook newe.sfx.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation UltraHook newe.exe -
Executes dropped EXE 3 IoCs
Processes:
UltraHook newe.sfx.exeUltraHook newe.exeCrypt.exepid process 3504 UltraHook newe.sfx.exe 3284 UltraHook newe.exe 3932 Crypt.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe vmprotect behavioral2/memory/3284-21-0x0000000000140000-0x0000000000340000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\Crypt.exe vmprotect behavioral2/memory/3932-34-0x000001CDF61E0000-0x000001CDF63A6000-memory.dmp vmprotect -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exeUltraHook newe.sfx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UltraHook newe.sfx.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Crypt.exepid process 3932 Crypt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Crypt.exedescription pid process Token: SeDebugPrivilege 3932 Crypt.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exeUltraHook newe.sfx.exeUltraHook newe.exedescription pid process target process PID 1556 wrote to memory of 3504 1556 6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe UltraHook newe.sfx.exe PID 1556 wrote to memory of 3504 1556 6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe UltraHook newe.sfx.exe PID 1556 wrote to memory of 3504 1556 6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe UltraHook newe.sfx.exe PID 3504 wrote to memory of 3284 3504 UltraHook newe.sfx.exe UltraHook newe.exe PID 3504 wrote to memory of 3284 3504 UltraHook newe.sfx.exe UltraHook newe.exe PID 3284 wrote to memory of 3932 3284 UltraHook newe.exe Crypt.exe PID 3284 wrote to memory of 3932 3284 UltraHook newe.exe Crypt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6512ee54cb87daf804d1d337785c947e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\UltraHook newe.sfx.exe"C:\Users\Admin\AppData\Local\Temp\UltraHook newe.sfx.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe"C:\Users\Admin\AppData\Local\Temp\UltraHook newe.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\Crypt.exe"C:\Users\Admin\AppData\Local\Temp\Crypt.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD50088abee944713ab183c41f3a2b07ea8
SHA1ea027d6de4b2feebfb35b4ebde88cdaab6d6e744
SHA2568ce4be0ab67c82e4f9023bbea4228430e56ef9ac133d377d75ecf2be75045111
SHA51298c88b5f4d4b30f922fbd219da691842649e7aa39eeac65a8b21ad0bdd9437ace260bdf744910690b3d004fda16f1f267f78c307741526e8ba6bde3558f4c64d
-
Filesize
1.0MB
MD535c69ab07ba4fd97cb23a0351d7293b6
SHA165c3a14d30364f80ebda6cd1b83c6f9633291c35
SHA256f6d38b7dda48f70fabd8cf49cfb5191ef8bb4f351629c06ec102630d852da81c
SHA512072d19611df7a7807a4edff57befe8568132925b493cc7484684b59ef7cee31649eca13adafd3023f0a444241af6e571325880760b534990dfbac6a71bba1a70
-
Filesize
1.3MB
MD506670ce4174643ad43c413115c8fde00
SHA16b7ecb0a6c058d6bd008121478178847bfa59b9b
SHA256af4b0b4e4184e5283032f0b141bd2aac39241624471888061bd6cfe661ff24fc
SHA512ef119712659b877f65310635552898c2518aae66a7e836db5ef699ec52ca21f95e040547f40175a0f9f0329aead206c800d7b6756e78e61321564d45d6ec3dc1