Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2024, 06:36

General

  • Target

    84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    84e02b7e01c3cf953b300905a9865d81

  • SHA1

    745c8957ada912a0272bbc3985ffa4b0eac3dc16

  • SHA256

    156ea726a0ad6c8d77a5bdd4c7ed8581ea72bc77e3b3e011307e7fb706237c51

  • SHA512

    4d2981693e05cfd559d53c2a97f7a68f8b03149cf9473c087f810ba8e73dffed5600f2b85964891f4ac303a0bbb986056900caf75de0ffa2f82c3a21fa2c1ad2

  • SSDEEP

    49152:hOBcPtDsZ5CqzSD8ybRS3sYDoijJJADMnfknANKkgX25zPf2C397zS:hONZ5F

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 44 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
      "C:\Users\Admin\AppData\Local\Temp\teste1_p.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2104
    • C:\Users\Admin\AppData\Local\Temp\q1.exe
      "C:\Users\Admin\AppData\Local\Temp\q1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1080
    • C:\Users\Admin\AppData\Local\Temp\avto.exe
      "C:\Users\Admin\AppData\Local\Temp\avto.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2880
    • C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
      "C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 160
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2648
    • C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
      "C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2768
    • C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
      "C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe"
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_win_path
      PID:2696
    • C:\Users\Admin\AppData\Local\Temp\2_load.exe
      "C:\Users\Admin\AppData\Local\Temp\2_load.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c del "C:\Users\Admin\AppData\Local\Temp\2_load.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2964
    • C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
      "C:\Users\Admin\AppData\Local\Temp\1your_exe.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1YOUR_~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1444
    • C:\Users\Admin\AppData\Local\Temp\1269190981.exe
      "C:\Users\Admin\AppData\Local\Temp\1269190981.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1480
    • C:\Users\Admin\AppData\Local\Temp\1_barac.exe
      "C:\Users\Admin\AppData\Local\Temp\1_barac.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2196

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\ErrorPageTemplate[1]

          Filesize

          2KB

          MD5

          f4fe1cb77e758e1ba56b8a8ec20417c5

          SHA1

          f4eda06901edb98633a686b11d02f4925f827bf0

          SHA256

          8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

          SHA512

          62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\background_gradient[1]

          Filesize

          453B

          MD5

          20f0110ed5e4e0d5384a496e4880139b

          SHA1

          51f5fc61d8bf19100df0f8aadaa57fcd9c086255

          SHA256

          1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b

          SHA512

          5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\httpErrorPagesScripts[1]

          Filesize

          8KB

          MD5

          3f57b781cb3ef114dd0b665151571b7b

          SHA1

          ce6a63f996df3a1cccb81720e21204b825e0238c

          SHA256

          46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

          SHA512

          8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\info_48[1]

          Filesize

          4KB

          MD5

          5565250fcc163aa3a79f0b746416ce69

          SHA1

          b97cc66471fcdee07d0ee36c7fb03f342c231f8f

          SHA256

          51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859

          SHA512

          e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\navcancl[1]

          Filesize

          2KB

          MD5

          4bcfe9f8db04948cddb5e31fe6a7f984

          SHA1

          42464c70fc16f3f361c2419751acd57d51613cdf

          SHA256

          bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228

          SHA512

          bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\yekhhiijfg[1].htm

          Filesize

          125B

          MD5

          45a9a2084a44d18bd0f446d6855908e4

          SHA1

          2b00aab2d6fd2e8fe429facce198d7093559adf1

          SHA256

          2ef87fbd5f3ec904bc116f3654421f4c53dc5438bbf36fa029dc8af8813f9646

          SHA512

          5e5d0c962cfa6faffafd32e10d1e38d90e12c184ab77d72907108b98bf73bdee685300c44ffae937203c7f74ecb8110794b542a4c3ba4831c9b3bafc77dc4d84

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\bullet[1]

          Filesize

          447B

          MD5

          26f971d87ca00e23bd2d064524aef838

          SHA1

          7440beff2f4f8fabc9315608a13bf26cabad27d9

          SHA256

          1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d

          SHA512

          c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\errorPageStrings[1]

          Filesize

          2KB

          MD5

          e3e4a98353f119b80b323302f26b78fa

          SHA1

          20ee35a370cdd3a8a7d04b506410300fd0a6a864

          SHA256

          9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

          SHA512

          d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

        • C:\Users\Admin\AppData\Local\Temp\1269190981.exe

          Filesize

          81KB

          MD5

          a81cba51a8e0a4a46d2da44caeff63cd

          SHA1

          fbcc341075298d95e9f4685556686380b621989c

          SHA256

          3b671780d55eb7a8f7c3e57be194d23bc2946e39c4884296e14c5b6c81ac3ed3

          SHA512

          eac61ab0d9d7a6b090e03b836c3ff4dc3e11578e08791ff41c1896345b156355c8cd59ee02af63c173eaf3473f6f735f3347da209bfd50fb790e381c689d8776

        • C:\Users\Admin\AppData\Local\Temp\1_barac.exe

          Filesize

          42KB

          MD5

          69b74e9361667f788cf0f1af62e0ea75

          SHA1

          313c0f205615de074111851c2cb1ea5bc38a2be8

          SHA256

          5d6446096db3fe70e9e7f098b6bbf5bd0d1cdffbb8e487a91228ea0d9ced1c1a

          SHA512

          a05bff03eea90379d02a07bd3dc77a7482ce5dc1cd609744c3559c4a75d361d87ad4a979f302d27c8ca94b47bf50ea72098115c1ac3860511219e3df1369b78a

        • C:\Users\Admin\AppData\Local\Temp\1your_exe.exe

          Filesize

          20KB

          MD5

          f11699c753aa3b403ee810d14aaa8907

          SHA1

          4d7c6f7564b4aa20310499c8a9cf46aa3c65560c

          SHA256

          7a2633419743680bc2f30216580effd93583b4f180538411aa8103e37c5dd533

          SHA512

          1c97cf9f98bf1e8c0cfdc62a4f140e854dfccb8655a8a8ea6592ae42141f9b70da79ae27028eb05fc41617b10fac56ef4cc3bde0574de8dbb4cd6f4be784639e

        • C:\Users\Admin\AppData\Local\Temp\2_load.exe

          Filesize

          16KB

          MD5

          eab0da403a9f596485b4c231f24e41ab

          SHA1

          384c06c067e7b66935c2dba44d77ab5b2ce4b2e5

          SHA256

          00fdc28881dae4748fbc7f0daecf8907128deb351d1d28950b66f7ad4fa83837

          SHA512

          6fae3390e77303f4318778d95105e06b98b5a910a38fb85db937129947f1b98f01ed9d9156b88a18e01ca1eec0a7ac6232aadfeb8f7ff4044bac55d64f588884

        • C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe

          Filesize

          39KB

          MD5

          254363c5bc75c63a6f9fdae5aec17aa1

          SHA1

          2e3e3d74212fe3c91407bf059794a65417018a8c

          SHA256

          061908d8a76056698270a0f47089cfd5a246bec8494ebd2ca0a2d278fd790a20

          SHA512

          0f2b5d5ca694c2d768f43ae68adb515cdb06382282c2bea08fd2bd1cafe924f0ef4e4f20800ef5e413292b1bc29a3e5c1316c64503ee23beb2e54ded4e4b8d5e

        • C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe

          Filesize

          279KB

          MD5

          46399ada349010e0945d6a8ba69137d3

          SHA1

          468efa26f445d54ba703501109159f7d85a2df51

          SHA256

          4b1f59a3c47e015ef50f5092539e40ffa92b5ccae88dbfec828d0d9414c33af0

          SHA512

          ecc847376426d21b6f610e2427578edc9e5a8e0082579a6e7b8b2b493b6904661236b47533533064020e2aca63ecc2d1e35539a5b252f7e3cfce19c2ff3a2383

        • C:\Users\Admin\AppData\Local\Temp\Cab2676.tmp

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\Local\Temp\Tar26D7.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • C:\Users\Admin\AppData\Local\Temp\avto.exe

          Filesize

          274KB

          MD5

          99dae998144126e8774b6e57497e1930

          SHA1

          34aed0238c911e5e9475822aec31d545ae1961e1

          SHA256

          81bff218030142ace3a8f4dcf9ff14f96fddccd6c821aff45798e1701b69e991

          SHA512

          33f3cd28ca48a0466093ce44b137097a86fe5eb499424a244db0504cad1ee95196a56c40281d2c960fa6cd4f2d65cbd4f92411ef0c582ed8d1c210726b213a56

        • C:\Users\Admin\AppData\Local\Temp\q1.exe

          Filesize

          278KB

          MD5

          406b63d114199ce9930bfc4a1a6b60dc

          SHA1

          babf4ee8226b7625cdf19a04c05ad4460bc3bd14

          SHA256

          a00aea2e9ada85124b140d294d87c1ae326eec4527f7fa65861d1b468a5c02da

          SHA512

          c1297a85b9b8afd2058486a7df0683a104f1087bedb6c3b67f1f33a7c2395dbe9f35b01a1a6684f50db675f6555fd391b172cfbc641373e563d2ca04a0ee50b4

        • C:\Users\Admin\AppData\Local\Temp\teste1_p.exe

          Filesize

          334KB

          MD5

          8d9e5086a4aace8642feecff39a5eeb0

          SHA1

          7ab655ded632b658847666666464fc337ff5deb2

          SHA256

          7eb7190ff9c33ce5db5b7df8dba33571c1347e865e66c7212c661c4b3e4af3f3

          SHA512

          ec60672593e7e05c51cc4fca258250eeaaba789c42fdbc5a948642e1776434f18badc0cc650fc7e62f60cf89e00d3134c302316425e20e41b3252352b43ff9fd

        • \Users\Admin\AppData\Local\Temp\6_ldry3no.exe

          Filesize

          82KB

          MD5

          bfc08d0dcdf0b6af01079c736be73b5e

          SHA1

          967c84e54168256e2ad7bb78cc35c8e7e9d5767b

          SHA256

          d57cff8fd945721b53c59cee9f97a69d5f6d3fb346ca0fb7066e5a740b252a3a

          SHA512

          cb46c1e52f8b13c416c52e41b1f26a29cb48bce461675916c109d1f43043c9dc082431644bab94b4d0f0203b88062d06baaa7c016785a5586132bc4264f9b0ee

        • memory/324-140-0x00000000026F0000-0x00000000026FB000-memory.dmp

          Filesize

          44KB

        • memory/324-139-0x00000000026E0000-0x00000000026EB000-memory.dmp

          Filesize

          44KB

        • memory/324-137-0x0000000000401000-0x000000000048E000-memory.dmp

          Filesize

          564KB

        • memory/324-143-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

        • memory/324-142-0x00000000026F0000-0x00000000026FB000-memory.dmp

          Filesize

          44KB

        • memory/324-3-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

        • memory/324-1-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

        • memory/324-0-0x0000000000401000-0x000000000048E000-memory.dmp

          Filesize

          564KB

        • memory/324-141-0x00000000026F0000-0x00000000026FB000-memory.dmp

          Filesize

          44KB

        • memory/324-176-0x0000000000401000-0x000000000048E000-memory.dmp

          Filesize

          564KB

        • memory/324-177-0x0000000000400000-0x00000000005E0000-memory.dmp

          Filesize

          1.9MB

        • memory/324-138-0x00000000026E0000-0x00000000026EB000-memory.dmp

          Filesize

          44KB

        • memory/1080-66-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1080-187-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1080-358-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1080-340-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1080-181-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1080-35-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1104-192-0x0000000000400000-0x0000000000910000-memory.dmp

          Filesize

          5.1MB

        • memory/1104-309-0x0000000000400000-0x0000000000910000-memory.dmp

          Filesize

          5.1MB

        • memory/1480-184-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2076-194-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2076-146-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2104-357-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2104-179-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2104-339-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2104-68-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2104-19-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2104-178-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2104-372-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2104-395-0x0000000000400000-0x00000000004D0000-memory.dmp

          Filesize

          832KB

        • memory/2196-195-0x0000000013140000-0x0000000013156000-memory.dmp

          Filesize

          88KB

        • memory/2696-191-0x0000000013140000-0x0000000013181000-memory.dmp

          Filesize

          260KB

        • memory/2768-315-0x0000000000400000-0x000000000047C000-memory.dmp

          Filesize

          496KB

        • memory/2768-190-0x0000000000400000-0x000000000047C000-memory.dmp

          Filesize

          496KB

        • memory/2872-188-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/2872-67-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/2880-182-0x0000000000400000-0x000000000047B000-memory.dmp

          Filesize

          492KB