Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe
-
Size
524KB
-
MD5
8321633d0adb8e8c5d4ee266b6e4571f
-
SHA1
78d711c7ba93977bbaf2ab7a534bb1327682e868
-
SHA256
1e4973451eeee8e455fd86e1cf779758b5c70c770d566da2f6040cfe0e14c162
-
SHA512
c60f41eab9990dd7afa81216688d88cf5353c412b0df48e23f38af2e1784523752d76ff75eab9d8b9b84d140142db97556c06eae178565fe55ff82a6f25effcd
-
SSDEEP
6144:yRMq0I7jjh6pG6FcGMk6kPVgcGdYSauUvNr9nhyTCYaCQIC14a:m7jj4GicVUPV/GdwuUV5qCDCZC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2808 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2848 set thread context of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2748 timeout.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 2848 wrote to memory of 3032 2848 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 30 PID 3032 wrote to memory of 2808 3032 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 31 PID 3032 wrote to memory of 2808 3032 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 31 PID 3032 wrote to memory of 2808 3032 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 31 PID 3032 wrote to memory of 2808 3032 8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe 31 PID 2808 wrote to memory of 2748 2808 cmd.exe 33 PID 2808 wrote to memory of 2748 2808 cmd.exe 33 PID 2808 wrote to memory of 2748 2808 cmd.exe 33 PID 2808 wrote to memory of 2748 2808 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8321633d0adb8e8c5d4ee266b6e4571f_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\832163~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\timeout.exetimeout 54⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2748
-
-
-