Overview

overview

7

Static

static

3

8efc96f06d...18.exe

windows7-x64

7

8efc96f06d...18.exe

windows10-2004-x64

7

$PLUGINSDIR/InetC.dll

windows7-x64

3

$PLUGINSDIR/InetC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI..._1.dll

windows7-x64

3

$PLUGINSDI..._1.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI..._0.dll

windows7-x64

3

$PLUGINSDI..._0.dll

windows10-2004-x64

3

$PLUGINSDI..._1.dll

windows7-x64

3

$PLUGINSDI..._1.dll

windows10-2004-x64

3

$PLUGINSDI..._4.dll

windows7-x64

3

$PLUGINSDI..._4.dll

windows10-2004-x64

3

$PLUGINSDI..._0.dll

windows7-x64

3

$PLUGINSDI..._0.dll

windows10-2004-x64

3

$PLUGINSDI..._0.dll

windows7-x64

3

$PLUGINSDI..._0.dll

windows10-2004-x64

3

Chrome/CT3...ger.js

windows7-x64

3

Chrome/CT3...ger.js

windows10-2004-x64

3

Chrome/CT3...yer.js

windows7-x64

3

Chrome/CT3...yer.js

windows10-2004-x64

3

Chrome/CT3...ack.js

windows7-x64

3

Chrome/CT3...ack.js

windows10-2004-x64

3

Chrome/CT3...ont.js

windows7-x64

3

Chrome/CT3...ont.js

windows10-2004-x64

3

Chrome/CT3...ete.js

windows7-x64

3

Chrome/CT3...ete.js

windows10-2004-x64

3

Chrome/CT3...ion.js

windows7-x64

3

Chrome/CT3...ion.js

windows10-2004-x64

3

Analysis

  • max time kernel
    139s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8efc96f06de0f618b21af5132d5cab7c_JaffaCakes118.exe
  • Size 2.4MB
  • Sample241104-ea62gatbrp
  • SHA256 d7099e78758ae427ecc245271a35fec06099f96a141dbe57ce3816eba37cdba7
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8efc96f06de0f618b21af5132d5cab7c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8efc96f06de0f618b21af5132d5cab7c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CT3298573.xpi
        • Path C:\Users\Admin\AppData\Local\Temp\CT3298573\CT3298573.xpi
        • Size 1.4MB
        • SHA256 cb9ff2368e72c97d2d1f3d1d7a73ca18d02fd4dbc48b0624e077574300fca54c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        conduit.xml
        • Path C:\Users\Admin\AppData\Local\Temp\CT3298573\conduit.xml
        • Size 785B
        • SHA256 bd776b8985180368e76e9bd42d1aedd131e9fbf69c2e1d40b2181298de9cb62f
        • MD5 SHA1 SHA512
        Submit Download

        nsjB371.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\nsjB371.tmp
        • Size 307B
        • SHA256 4f66463e5b2324b27f4ab9ebcfb12642bf93da09a64898c942b9a7e7961debab
        • MD5 SHA1 SHA512
        Submit Download

        InetC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nslAEA1.tmp\InetC.dll
        • Size 23KB
        • SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nslAEA1.tmp\System.dll
        • Size 11KB
        • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsCRandom_1_0_1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nslAEA1.tmp\nsCRandom_1_0_1_1.dll
        • Size 139KB
        • SHA256 5efd476cb861695bfbd04ccdbb952655d40a393a30d8490e474a48c3937c62f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsJSON_2_0_1_0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nslAEA1.tmp\nsJSON_2_0_1_0.dll
        • Size 81KB
        • SHA256 83c44cfcc5c0fe4987453e6306c55e2f2e62bb2be2297acae92f047ab8ad9e47
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsPrefsJs_1_0_0_4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nslAEA1.tmp\nsPrefsJs_1_0_0_4.dll
        • Size 169KB
        • SHA256 cad8134fff16bcc5d39037e63b5248c70ed56b057546ebd3d8c3730c4fd5a563
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsUtils_2_1_12_0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nslAEA1.tmp\nsUtils_2_1_12_0.dll
        • Size 301KB
        • SHA256 7adb7478a489b7e864d31c0233c0d46ff289ab23b5ec9cee0f54c00e2abb6bba
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsZip_1_0_3_0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nslAEA1.tmp\nsZip_1_0_3_0.dll
        • Size 224KB
        • SHA256 b40097ebc411f2c06fa9ca7d653c145a2831242584e0d47d9ee32a9e22e4518d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        defaultsdefaultSearchUrl.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\extensions\{eef3855c-fc2d-41e6-8d91-d368f51b3055}\defaults\preferences\defaultsdefaultSearchUrl.js
        • Size 1KB
        • SHA256 267e3a4f2c555daad3471866245f4310137d010e03a7b4175d9d266fb350f0f6
        • MD5 SHA1 SHA512
        Submit Download

        defaultssearchAddressUrl.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\extensions\{eef3855c-fc2d-41e6-8d91-d368f51b3055}\defaults\preferences\defaultssearchAddressUrl.js
        • Size 1KB
        • SHA256 3f80a07314e0b63846131474d99e807e2d6c3432826c262f517129d8f27151cc
        • MD5 SHA1 SHA512
        Submit Download

        defaultsstartPageUrl.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\extensions\{eef3855c-fc2d-41e6-8d91-d368f51b3055}\defaults\preferences\defaultsstartPageUrl.js
        • Size 1KB
        • SHA256 1bc9cea82e5548d0a44c18bb5d570f96440ead65e7d13606d8a21dbe1e1a8e82
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 256B
        • SHA256 c3289d0acde2edeb217d9bbfa728edb9217b7fbbdcf32b9a8b3817e4e27b5e97
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 407B
        • SHA256 b79a9eb3cb884f97f8ca47d7d5401307a1a33efd83ae4cc2103b3475e07ad6ff
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 474B
        • SHA256 769a52d4cba2b15f99db1bca6fa6c35517cd54d1b11d0812cdc0f683924d5187
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 578B
        • SHA256 5526b5ab053ec3e1adba14c7f6c0a674c97991bc2e6c0ed8a028ab4810afd808
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 1KB
        • SHA256 dbe76d47c911a561b0ed55862896f26b3e1ac7d5c85f42f24e7f105e87165c7f
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 124B
        • SHA256 a653dac2fd65ae975aad586477e1db1e2be7a4cb9cb452b3275c1b139610d6c6
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 534B
        • SHA256 f4c18e1f0adaa840402a4d13163f579fd03837ce4a4c7e3a1e0d158741910924
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 625B
        • SHA256 d3515106242240088e37fbed4a4d418e88c2de6f4bc60e9560029c2ea07889da
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 813B
        • SHA256 8ba8149dcb773f1b40d2eb90126f876a6128a471fe65b3129b9b17a52a359bc8
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 673B
        • SHA256 14aea4fc11e5392bc00a019aba63dc835a136a7882b80b8f653ebd9e66b91a4e
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs1.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs1.js
        • Size 718B
        • SHA256 f62101a52160fd58bb9c4cd53866a3775479a52f1331931fd653b68c468f1c98
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs2.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs2.js
        • Size 2KB
        • SHA256 c05c750972139a66f1e42d1fe6cf258265b8d896b8dd292ef1f5e1bdb057a55c
        • MD5 SHA1 SHA512
        Submit Download

        newPrefs3.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\newPrefs3.js
        • Size 1KB
        • SHA256 bb43c4061db8c4237e87ca1fc626c58e42000cc297fba66c8d14eee00721dd0a
        • MD5 SHA1 SHA512
        Submit Download

        newConduit.xml
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5keoqj3l.Admin\searchplugins\newConduit.xml
        • Size 997B
        • SHA256 5f476536f068c72c8c586c59d7f22d3d390ad3902260051d1d78dd90dbd9e3f9
        • MD5 SHA1 SHA512
        Submit Download