Overview

overview

7

Static

static

3

68b6b5a31f...18.exe

windows7-x64

7

68b6b5a31f...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    133s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/10/2024, 03:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    68b6b5a31ff9f2f512dca964581b3097_JaffaCakes118.exe
  • Size 717KB
  • Sample241022-d5fx4awgrp
  • SHA256 24b14c1a74fb90f0ae63b2adeb76822575e7d5bfc30e56fbfc416532c2c730bd
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\68b6b5a31ff9f2f512dca964581b3097_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\68b6b5a31ff9f2f512dca964581b3097_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Users\Admin\AppData\Local\Temp\00294823\JPMRzgpe2.exe
      "C:\Users\Admin\AppData\Local\Temp/00294823/JPMRzgpe2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • System policy modification
      PID:3124

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        FBzPhxtA.dll
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\FBzPhxtA.dll
        • Size 222KB
        • SHA256 a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FBzPhxtA.tlb
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\FBzPhxtA.tlb
        • Size 2KB
        • SHA256 c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941
        • MD5 SHA1 SHA512
        Submit Download

        JPMRzgpe2.dat
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\JPMRzgpe2.dat
        • Size 5KB
        • SHA256 000004f5ad97e7e6f69f9d79e13c52149d24569f62ede30fe5f4a2c20baa21cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        JPMRzgpe2.exe
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\JPMRzgpe2.exe
        • Size 334KB
        • SHA256 f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2dLRTrh2v.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\eefkbjdkkeklnohhdjjondjndgnicpfo\2dLRTrh2v.js
        • Size 5KB
        • SHA256 147d94597c20ad8f97af976b7ff6e40b962acd39b4a3a449812395dc84a5556e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        background.html
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\eefkbjdkkeklnohhdjjondjndgnicpfo\background.html
        • Size 146B
        • SHA256 9c3e046e0c2571104c17bfad1d046f7033266baad683aa9244ff3c4cd88c0c8d
        • MD5 SHA1 SHA512
        Submit Download

        content.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\eefkbjdkkeklnohhdjjondjndgnicpfo\content.js
        • Size 197B
        • SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
        • MD5 SHA1 SHA512
        Submit Download

        lsdb.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\eefkbjdkkeklnohhdjjondjndgnicpfo\lsdb.js
        • Size 559B
        • SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
        • MD5 SHA1 SHA512
        Submit Download

        manifest.json
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\eefkbjdkkeklnohhdjjondjndgnicpfo\manifest.json
        • Size 508B
        • SHA256 4c8ae86d532df9e125b3694ec0cc678e445cc9312dc018f536db34a308d642e8
        • MD5 SHA1 SHA512
        Submit Download

        sqlite.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\eefkbjdkkeklnohhdjjondjndgnicpfo\sqlite.js
        • Size 1KB
        • SHA256 161c1837342268fdccb4aa584f2675d5e9447c30a372121e0ec4d69668e66209
        • MD5 SHA1 SHA512
        Submit Download

        bootstrap.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js
        • Size 2KB
        • SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
        • MD5 SHA1 SHA512
        Submit Download

        chrome.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest
        • Size 110B
        • SHA256 37e8e22609c34bfcdc310dbcbb641acac91863bf74882f6ab5aa4de7ca6c8cd5
        • MD5 SHA1 SHA512
        Submit Download

        bg.js
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js
        • Size 9KB
        • SHA256 5676618ccf8b425654ffcb2cb736bbf6f62ecafaf50acaf33542259670993041
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        install.rdf
        • Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf
        • Size 608B
        • SHA256 273e5a2f00506f3aa77c4eceacfa8185ae2f78c6ce3b78e11ec643a821c01761
        • MD5 SHA1 SHA512
        Submit Download