Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2024, 08:53

General

  • Target

    66344790490e1b9551a68a1a135be65e_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    66344790490e1b9551a68a1a135be65e

  • SHA1

    f15c6b6bc5642c93b1d6983b12e45aa03cc30d92

  • SHA256

    cf586a9fb45427d9857814c472161d07e07d439d0ba148b0f267324bebe0fc4e

  • SHA512

    4e4129f3a8819ed0658db2b7f23ca333a4a3136783abe40c560a821292e5681d79bae7af6ce3166bf3f14044f57e07f8bac983e10e48416735cc8ac08f3a478c

  • SSDEEP

    24576:PLi9nQF03lr6sducQrEWuaEHEa/EV+1sidWJCZ:PLmnQF0BBsmHgV8o0

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66344790490e1b9551a68a1a135be65e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\66344790490e1b9551a68a1a135be65e_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Users\Admin\AppData\Local\Temp\00294823\ti7kCwFIGG.exe
      "C:\Users\Admin\AppData\Local\Temp/00294823/ti7kCwFIGG.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • System policy modification
      PID:764

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\00294823\GW_QXurE9.dll

          Filesize

          258KB

          MD5

          e1d10cccd5dde588af8ee2cb7309523c

          SHA1

          0b9e805077320b0ce1e6620488bd34f1c4d7827e

          SHA256

          9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

          SHA512

          a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

        • C:\Users\Admin\AppData\Local\Temp\00294823\GW_QXurE9.tlb

          Filesize

          2KB

          MD5

          9156db5f76d48049dbc41fd1b58b3f34

          SHA1

          5eb1df59f9b5b06ab00137fc9e6451e323d3102c

          SHA256

          66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

          SHA512

          742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

        • C:\Users\Admin\AppData\Local\Temp\00294823\GW_QXurE9.x64.dll

          Filesize

          319KB

          MD5

          4f5c722b8686afbea6f09c53171d44ca

          SHA1

          184c60aafbb12d1023b1ce2aff4d3708607a75a1

          SHA256

          870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

          SHA512

          e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

        • C:\Users\Admin\AppData\Local\Temp\00294823\kmlfegoohblggjefblgmnekkkdelbbdi\0K395mHtUv.js

          Filesize

          5KB

          MD5

          46bc1d4531ca7a31644036b5ce2d2cd0

          SHA1

          6857d86fab8886d718b636ec33dafe9bd77099a7

          SHA256

          817c62842d6fbfac379ba1533f6343368ec57ceeccd61a5ac583933cb7df6d29

          SHA512

          96f87f956d5487f1f783c39a4a680b266140a86611e90f937e0f7d7e04491cde7a0aa541ff4175edba96097a3a6ba1beb568605fa7cf20bcc5d31d082da2a357

        • C:\Users\Admin\AppData\Local\Temp\00294823\kmlfegoohblggjefblgmnekkkdelbbdi\background.html

          Filesize

          147B

          MD5

          086474bf4d09cbfb715987f8621f2250

          SHA1

          9b24b65b09a69dbdcd15e33bf91b59cc4a007d9f

          SHA256

          4761791092a697a6e985828f50e26c31c6b88b3d61b0eeb58b66d8e4feaecf87

          SHA512

          9c56af3ad30574b1cd59e6ecc3bf0e2cd2b99186fa76e94186c0923a6c0820e21d64aaa866e4ff72b769f6b8250d00d1bc3536650f352b83bd80d6dddc2facb1

        • C:\Users\Admin\AppData\Local\Temp\00294823\kmlfegoohblggjefblgmnekkkdelbbdi\content.js

          Filesize

          197B

          MD5

          5f9891607f65f433b0690bae7088b2c1

          SHA1

          b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

          SHA256

          fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

          SHA512

          76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

        • C:\Users\Admin\AppData\Local\Temp\00294823\kmlfegoohblggjefblgmnekkkdelbbdi\lsdb.js

          Filesize

          559B

          MD5

          209b7ae0b6d8c3f9687c979d03b08089

          SHA1

          6449f8bff917115eef4e7488fae61942a869200f

          SHA256

          e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

          SHA512

          1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

        • C:\Users\Admin\AppData\Local\Temp\00294823\kmlfegoohblggjefblgmnekkkdelbbdi\manifest.json

          Filesize

          511B

          MD5

          a2d5ec1b2ea459e6b8a8c9d4f867622d

          SHA1

          8460611cb8300fda4d4a81a10f4186f5233804fd

          SHA256

          051a9b7b0a4f909e3dab5695d3096ef90b586c7ba9860edccd0464918d6697db

          SHA512

          0fbd5f1542ef543a31654cfb8ed722441ba4c166076e5bc2980b8d3a0a8b1ba6a2ad83f46b07e83b522c4df5cd4c30dbd0d9455b90f2a10909d0364b9015d8c4

        • C:\Users\Admin\AppData\Local\Temp\00294823\kmlfegoohblggjefblgmnekkkdelbbdi\sqlite.js

          Filesize

          1KB

          MD5

          8242c014bff3dc07fe562a07e8567c13

          SHA1

          e1781d38a630ad67892fcdd874513339c66af8e6

          SHA256

          9251ee3f2bf4fb2ae361b87786bde4f6fbc2fa413e00961caa50b7d4d1996199

          SHA512

          a6d49b6a61605b59018e8a093e8100e5d5d4a7399173af44d481aa6a8662a8ac10cb170f8b24a395ab006c27d0012853a46852fe8a518118995bb5e41a02e1b8

        • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js

          Filesize

          2KB

          MD5

          1b53c596cfb1aa2209446ff64c17dabd

          SHA1

          2542da14728dcdbe1763f1ee39fe9ceae38ad414

          SHA256

          a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

          SHA512

          be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

        • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest

          Filesize

          112B

          MD5

          3472a525ce859e1ce793fd0a1cb80c3b

          SHA1

          52fe7bcee398ee043565a6fb09195cd381a17921

          SHA256

          03f00bc405c3b8f2de0e4b4984f16d5d285feb83252a0d4a358549075baed8de

          SHA512

          4107a80c9966a631ef8371ce3f61df4d202ee995e4f18d39f3ebfc2f375f5ffbea45fb727546b71a76051d398d1cf28607f43418403689285ca7d1a8958dbff0

        • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js

          Filesize

          9KB

          MD5

          1574b47dfdf308581489beaa2e7c5fa5

          SHA1

          94601bbb03a7a2571fd457771f0786d489fc4b15

          SHA256

          556d0b04ab3a08438508e6d6671520a733778891fb4ca4481196131eef5ea15b

          SHA512

          8f7a48475b50027cf7d1fd6abb2c3d314bb5680eeba16c92f0c8ecefcf43f7447315d474a9f1288f052660cddf67872c8e7101ef5c332d8a9e50ef2a0e4950fa

        • C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf

          Filesize

          612B

          MD5

          e112be8f61059957321f5a3ad7184cec

          SHA1

          79bc71b5c45ec0716cae92d2ba647a3f281fe924

          SHA256

          c806d3fb1532eb38e4a456e4dc78aa11e7dcf55a6a4256be8ebe08d0e73115fe

          SHA512

          1aa016b0d16e5b3e53fbc0558bbb486aa63992543cdfd61aaa3479e8e984f5029f60e6b9b7f14b082e87f64ee77468cc343c877e38cd79623e6104a1fcecb9ee

        • C:\Users\Admin\AppData\Local\Temp\00294823\ti7kCwFIGG.dat

          Filesize

          3KB

          MD5

          bc0692fcb37f3f10bbf7b0b0f50dcde7

          SHA1

          8e29d1949ed33882395d2e496a8c64036dc63d50

          SHA256

          9b94dd1410295f1826ba93decf9d39027f84cc92f8082de87359dbcc6cee434f

          SHA512

          aabb85b998d9718d83ab0ce0dc7503a5e69909116b5a8e2e79c6a21166a9630c5910c8a4acf5360df9cd58bd9825cabfd96ba93311f768cfaf43e91faad2b9cf

        • C:\Users\Admin\AppData\Local\Temp\00294823\ti7kCwFIGG.exe

          Filesize

          334KB

          MD5

          8300c91b40229b42301aebc6d8859907

          SHA1

          0b55e56a6add6b4dd4ceff475a0018a203d02a5a

          SHA256

          f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

          SHA512

          0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f