Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 12:06

General

  • Target

    82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    82f63475190e543b9c5d79d24bd6e91d

  • SHA1

    994fde79084e532203a1e473e71253a475598bb2

  • SHA256

    62e216ea83a6de60dc7439dfbe521d8a3d37cd6f2917ba06edf2b0da2e3fdcf9

  • SHA512

    dac98ca8409de3ed656d1ca106b1e31ec7e7d02c6fc55a3ef213872b5d7445f136adc6d7cc3a9118330e56ab3eff207c2a6dbf89b9817afd6e828682a8575375

  • SSDEEP

    24576:jh5bXVxQ2CeV6vNJAp7ElVVwoRPyBlDSpAj6+Uip5BBNMd:t5rQ2MNHhwoRPQ+Aj6+U2q

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Roaming\Terjemah Al-Quran.exe
      "C:\Users\Admin\AppData\Roaming\Terjemah Al-Quran.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:968

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Terjemah Al-Quran.exe

          Filesize

          321KB

          MD5

          44d93b216554246161fae3c68f790ee8

          SHA1

          de9fa5b712d2aa2d16c56a539823f2d1b90c3a7b

          SHA256

          56d018d187c245539c8f6078ee7b76f8cc55fd0cf3e1142c766380adfc80ed86

          SHA512

          524bfe37b57053857ca3fcc9b543303af90b5365c120253d45ba88bf5bf5a8596747e0f951f524d3fdb6afdaf899094ae7ceb06f454667170daa87a0a7bf3c21

        • memory/624-9-0x0000000000400000-0x00000000005A9000-memory.dmp

          Filesize

          1.7MB

        • memory/624-8-0x0000000000400000-0x00000000005A9000-memory.dmp

          Filesize

          1.7MB

        • memory/624-0-0x0000000000400000-0x00000000005A9000-memory.dmp

          Filesize

          1.7MB

        • memory/624-11-0x0000000000400000-0x00000000005A9000-memory.dmp

          Filesize

          1.7MB

        • memory/624-13-0x0000000000400000-0x00000000005A9000-memory.dmp

          Filesize

          1.7MB

        • memory/624-14-0x0000000002180000-0x0000000002215000-memory.dmp

          Filesize

          596KB

        • memory/624-12-0x0000000000400000-0x00000000005A9000-memory.dmp

          Filesize

          1.7MB

        • memory/624-7-0x0000000002180000-0x0000000002215000-memory.dmp

          Filesize

          596KB

        • memory/624-2-0x0000000002180000-0x0000000002215000-memory.dmp

          Filesize

          596KB

        • memory/624-23-0x0000000002180000-0x0000000002215000-memory.dmp

          Filesize

          596KB

        • memory/624-21-0x0000000002180000-0x0000000002215000-memory.dmp

          Filesize

          596KB

        • memory/624-27-0x0000000002180000-0x0000000002215000-memory.dmp

          Filesize

          596KB

        • memory/624-29-0x0000000000400000-0x00000000005A9000-memory.dmp

          Filesize

          1.7MB

        • memory/968-30-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB