Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2024, 08:43

General

  • Target

    662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    662d2b626bdb7e5685a7e45781382580

  • SHA1

    5b0ec800c2af4db04160ea1b89163939eed18081

  • SHA256

    3690f778383bf6668e90a3def4fe87a8878ab07b6ff1739d91064fa254424707

  • SHA512

    b249bbb221234c3828dc81b3b7bcef9a6ba9e043a8605c2e615208f45ffc61fd42eaa759ee9b1479b92a144f4f8fb524f070a8adffa2eb2bd832ebb47a058185

  • SSDEEP

    24576:hrJKUKRvzuei/bc6EGn5u5TtyJ8adjCzjyhhcDkPQcKiwMH5yUKc5thLfrXa7sju:h1Kbxzur/bc6/nRJ/aOheDkPQcKiwMHk

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Users\Admin\AppData\Local\Temp\crp11EC.exe
      /S /notray
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2784
    • C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe
      -home -home2 -hie -hff -hgc -spff -et -channel 162341
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Suspicious behavior: EnumeratesProcesses
      PID:2684
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.4shared.com/mp3/gjRF4A-N/jose_augusto_-_sentimento.html?ref=downloadhelpererror
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1600

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          1f38082938e769ef0283674200a172d0

          SHA1

          00f5579241132682ae83df44d8a4acb29f561b66

          SHA256

          a33eedcb26dbf4ecf7b73887bd9d36296628137b6594b131a2c1d7fd8c5bc48f

          SHA512

          35cdea94464407b5883b264a48a430ee3f38b9772df07279faeb91296759c3be17c71154767e9d82dc0dc86641e8ff64d776b40b1103ce786b44c9f765eb245f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          d673cb65e65f4fa040df2da85ca969bc

          SHA1

          c7bf3783e0c15a4aab750a3e0334f2bc772f0fd2

          SHA256

          4ed0e282b9bf272178329f2f568853ce10c44cd4fa8ecaeb2c98398cd57413fa

          SHA512

          dcc04c12dca6707713fe1c3813eb1a39aed94ebac5dc12d49749e31fff85cfda89d846d5f1e06f20a17f47cd88caeb44640c41d4c020818dc6de1eb4ae77805f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          7084e4f8ce479c2f82d683e882ad443c

          SHA1

          4f20d5fc920eaf40b25797ba6c2f39c98cecc3bc

          SHA256

          3d0e2dce0f8dca8d712ce8a917670b7d8fb953accf98589548e84d7a086785cf

          SHA512

          e3364e9eeae818afafa15722b880ad4b52c4751cec8dd4894f9700603b3c112547156c49a64f13b838af19068b72ec78d3a03e6d6b1a8b9ab171def13134511a

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          0956e00f46868550dbbe8554fa168546

          SHA1

          baca3004b33289ec0cf28496d2ef620678d07140

          SHA256

          5cc986f0f0a1b96ef2b8723dbf77df610f3ef3a8f899426b4ea1b34faa929fc3

          SHA512

          64df89b67ea22c33a09a45c9506cc489080c7ab9a176c37ae27277caa7d292192691837f102dc62e2536ac73c3b57e968f9ee352950fcf6fde5d1242df99c4d0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          4f96b98fdf69e6603b1a720d4db480f1

          SHA1

          d46737ce86690af041028c35c59e47419634e4b9

          SHA256

          5ec7093eaf9af72d896f46fa83813ab06a0833554d8295724dad2bb8834e3149

          SHA512

          9a6d7548d32c2884d8d140df4af8aae75c3ddb62e448dc00294620663e58908f0dfbd353f350a9f624281e1c7d443e87e59ce38a1eba6c559675e523ac330983

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          72e80ed6603e42fc24cd98a25c9237d7

          SHA1

          6066da16c39649bebf7dc2598c8c987a58b1aefd

          SHA256

          fb6f381d3028be6a776b41b890a8ad52e4d140b2e5c4e0ed49986fb42e833f29

          SHA512

          6945bdfff98f4de85621435e38fac209201c26abc985caa8f23e8ea33514d6677d67c9433e8206485d1777d9ca4f4a763c11609dc1351ddba961df93f61fecac

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          864664c496e94279eac47b67b886f02a

          SHA1

          2620fb0f7945b4ce10b34f7b1a5797a5919f864a

          SHA256

          755172fde8fcebc42244ab0a27ef530d3222f337175a221c508ffc73bdb480c8

          SHA512

          e3008b2bb16e9963793924d32652c3aeea17755a4a70465c10e3a93a10ccd0366f0d09c37e2e6ca913692545a6f3d1f40d50956a27e2aba2ca6bac9710a092f5

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          e92ee141069ff8e33a3bfc01c23b7ace

          SHA1

          65f25979cba3d913fbb0858350295ecccd3b5319

          SHA256

          14b582a832a8db83ee33f9f2c379c5a39c16f839ee7cb8854c8f680277f2addc

          SHA512

          b0ae4022aa9ff3b5b6cf1d36feaee152eaaf308531e7ac638168d339426cb61d63e0ccff833e2d819d66900598d4ce56ee6262afdfc269f5dbe7edb715ba42cf

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          b8c19f54501cd1873f23f1c2a5652107

          SHA1

          46582fc12ead86fec25794ec1e68de28886bcb4b

          SHA256

          7f26933d9bd0a78f8e7f762dbc3a8333cf1ef79f1b6534721a69a2758b4423ed

          SHA512

          7e39c4958a9d2c7c09403ecf88a04b4e2452735f5bb74727da25f8c2ff7cd8e33b7e7527779295b18d77d4665bfab5e80a3c8eccb9d5bfbeb2721766664950b0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          1b822e26505eced385003a922e6862a5

          SHA1

          a3820e1ea54356b4e7890a5a161d810373b2e336

          SHA256

          42842d6e4b70fe390e9a5bb891fc10b94c91ede94614531ba35098c8181415b8

          SHA512

          415681e0361ddd753f5a215f4b0aa5691474dc8431887a77f42cfe9c064fb4d0cc7fc4537a660cf9b084871234c17275e2190ebe4202921a8b798d901eafdaa1

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          fea9e0538ca5f36769bbba1a532e3cbb

          SHA1

          65d8413f2436c0186ab88b40bf123de54968ba57

          SHA256

          518bec616d81672bbd6dd7ec2cc5d7dc8ec0c0d270263873594c4f43b4e32590

          SHA512

          4f30b8c2c10b534a1dd96954f28c7bc908b3df906e7f27c064382a3244da3ca7a30a2e9448413364317790626d4486c5861772d421817609f8199118579823e0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          85bc1a08d1e2eb672fed75797d57e3a6

          SHA1

          a3dd00727158e52aa4a1111a0d020f0cf3f22359

          SHA256

          15826412e101733a66e3764a50ce6612e496116cf7f20b1b9222f9366abc4919

          SHA512

          358729dd9cbbd04cf4fce737a6063a2a9b920ad6957271e27d663b7de121d4c6b54ce8aee5eecaf563ea1bb582f2c7cfe34745c9a50eff5c8764a8b45de11783

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          370b000a8377b0194065d9c27b536533

          SHA1

          94076fa695d2875067c99992d32dc219b1170d99

          SHA256

          6d15a998916e127bd38deb835885362be3c3282cfd78d70b1d471912127bb16c

          SHA512

          39342e383eada3c3c85e7df505939ec23e13edb00c073d169136a43c849992d4826ec51ac297944df3afdff23e90d9044b91fe4714eee6b148424ed095d1a421

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          400da61609537d87ce208b5a8b56264d

          SHA1

          6ecdca9e26c65d12b8681a4700312b5a42e9cee4

          SHA256

          6e31d66ed50e64345b93134976ee8dec878463da29e5f3b8f77609ca93bb43c5

          SHA512

          a02c39bc6944c52b34be31d29a59fdbda37ba10a1cfc77e7ec6e537c21aaf1fcdae17c2802dbee8e9bf5a1cc23fcdc1a21469ba36531af6012facf54df6ade72

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          3b56bc20bf73f33c1518f333bca5cf89

          SHA1

          409cbae5f9d95443a6b8d3c69b24db15f39df81c

          SHA256

          3510cd4526e2866c6f0864fb78ea4c41029531cc014a6d45d07945fce66a0fa9

          SHA512

          3424d5c2114d61922b4f6beda8cc8c2cf181a922f27c4235d4e1abea8dcd5ea81d05c127802800d6ac14908269c867829dc82f2ff608794311622c093f1d15d9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          af70987dcb1c560a77c0921c0906daff

          SHA1

          388a59fa17e051950def32e9d63f38c50b6510a3

          SHA256

          67bbbca4e7dfba318b815baef17c890d4ec1aa4419090baa581ee482a035a28b

          SHA512

          5eaf0f9775a3cd438a0b200f7b3942529958a20c0b1fa8ffd4a6571905ab7b3073e34c65e3344481ea6c48d9f1649b8f774c129c37a09b9a88335e2438d24642

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          31153a558bdb3532aecf590bfbb721e2

          SHA1

          68e7118621085d43c5e04b699ea152f955628095

          SHA256

          4e485789a1286f51ae2fb2308ddc6f38b637291545c0aa153af95affb1af2765

          SHA512

          a2397c7ba44bee704a58840802dd2d659ab8db4a272b9a43c9455590eea0b8925e0046afebcfce6d6edfeda0a1c0c9e392ef82bdc7267777cadd0684ce36d793

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          bae333157f09a57ff08cfa7ff48f7f88

          SHA1

          b2a51250a01b2a1244efe3e3b78863452dfbda5f

          SHA256

          70d0c922914c4dd591b2c7f7f02df0c0b0c68ef8fa3da336e9988af5634f0865

          SHA512

          4f9e3cc5ba11aa3d53b2c15f6110539c2d1bc5d58c5c7f3d28d317ca2e11b6200eb7c05ab656c4d3c7c584046c780b80126c488d44966f6897230aee31cc799f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          91337a98850d6e1e8cb7bbd67d006daa

          SHA1

          fb58533de001eb142bd59462e9d3f8bb3e28c30c

          SHA256

          c5a24e9c292ffa73f20bfe03f179aa240bb9b5d093327a59842d487032b74d08

          SHA512

          e095b8c951dc7512e549c6c9f27a05063bbc937fdcffe384ae945da97db258d26cf95cfb8d275f9d908d4a8ccee8bf798ca3d4400cfa21bd731d6d937709cb95

        • C:\Users\Admin\AppData\Local\Temp\Cab2F1E.tmp

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\Local\Temp\Tar2F7F.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DGE198X7.txt

          Filesize

          71B

          MD5

          08c6aeed2eebb5a2368d374aee1e63d5

          SHA1

          6b8e7de013f1cea560021dd114f9ace0c1843df8

          SHA256

          0b94cf055651a87e71a75e26ee72a6d427889e115a0b276d29800c83f0460e0c

          SHA512

          ca8d3b255aa90c32b6a010942099fe02fdc0847313ca71f077bba7cfddc4dc2f8055e4bba12adea583c54e3958a386c9aecfa5f7e2ee9a364ac114e9788803ea

        • \Users\Admin\AppData\Local\Temp\crp11EC.exe

          Filesize

          806KB

          MD5

          14ec55240339c1239a400fbb9bc060a6

          SHA1

          428982e064e12a4ebc3dbaab1f205aa17ab6b7c3

          SHA256

          9755e30cf56ab363aa55a4b6a74896ab41011c448aaa6c8d658de97c231ff084

          SHA512

          56074ff17160fb81aa6e6f0e408c4e91f4e9a8607b0d8a21248cc3b0b632a461f4e2ea4deaa1918cb29c114bb4008f10ce49e32c776a956771b77521bbbbc29c

        • \Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe

          Filesize

          331KB

          MD5

          a3e93460c26e27a69594dc44eb58e678

          SHA1

          a615a8a12aa4e01c2197f4f0d78605a75979a048

          SHA256

          3a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6

          SHA512

          39d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530