Analysis
-
max time kernel
93s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 10:32
General
-
Target
a16a1326190655f327850b89d59080d9_JaffaCakes118.exe
-
Size
324KB
-
MD5
a16a1326190655f327850b89d59080d9
-
SHA1
d47bc9d82053e69cd125b6209d206230ed4a4e4c
-
SHA256
fa04330d160ca5c7c72acbd25728e57bdfc434ca4e3b543b73542e3ea8ddd604
-
SHA512
77c17a2ccb8507dd12f04c77174437dd83b6de5e5408c9ded2bbdfd1b1317a03c2b8211bceff7e234d9113753b2442c050ed59b924727c293dbfc2e6ecfc543a
-
SSDEEP
6144:7jktq8QVV/Bi84xKmiuBzSyYPXetqEaq7HgbAqM0ZNvfzDVlGLF:7MsVV/BB4xKmKPuIEakHgbAYNjiL
Malware Config
Signatures
-
Detect Neshta payload 43 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 6 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 3 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a16a1326190655f327850b89d59080d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a16a1326190655f327850b89d59080d9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe"C:\Users\Admin\AppData\Local\Temp\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\3582-490\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe" >> NUL4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3582-490\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe >> NUL5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe"C:\Users\Admin\AppData\Local\Temp\Ëîãèí ïàðîëü ïî÷òà ñåêðåòêà îò ïåðñà 135óð ðàçáîéêà.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\135~1.EXE"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\135~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\135~1.EXE4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD58ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA2568268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA5120b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
-
Filesize
294KB
MD519a6299fafd5618493c4c402f0d00e4b
SHA1aa0cad92bcae14fcaf147ae53d493bfb8b5532c0
SHA2565b4513c5c3610d54219bde05c4cb026d667ccf3836bda42fb31b0129beed6f0a
SHA5121a9dad1dcd3fe9d00d335f39bfc4bab2e520c3625d20d7dbbc59ff2966591d11544778cfd48d8bb63987b1a65b51b258c3be98adee127cfd91c81e1bd09220c6
-
Filesize
595KB
MD55ded80b3298448f200875c533dc7f578
SHA1fc366ef472dd3bfa49a0cf9f28bd2cfd4177afdd
SHA256ee2236d13bbde89936decef22282b8378ac56610b90749944baa3a690d7acb5b
SHA512a7dafb5d868b56d43e3eadfdb7deea44ad418e966ec9cbe073d13c5a2fedfe366faa5fbd796a84e3e1c1b9a408960ed2d2bcd179785c4b6c5a377a3a83105c42
-
Filesize
546KB
MD564c5c00694478ff090e483eebcd3d7a1
SHA1af47eaff535970e6178c1bc29a6eb68b874dcfe8
SHA256a9884e9141ca6f3d5f9a4fe781b104064f3b801d81263058f23b079c945a12f3
SHA5124df0b6e2f215ef1dd206e9c14eb233e6896ad9b846290edb344947db8f9bcaec5c39777c9dac33aee85433ed3178188c7622ba8ff0b4d2462a80820f338ca495
-
Filesize
325KB
MD59a8d683f9f884ddd9160a5912ca06995
SHA198dc8682a0c44727ee039298665f5d95b057c854
SHA2565e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
SHA5126aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
-
Filesize
325KB
MD5892cf4fc5398e07bf652c50ef2aa3b88
SHA1c399e55756b23938057a0ecae597bd9dbe481866
SHA256e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
SHA512f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
-
Filesize
146KB
MD5cdc455fa95578320bd27e0d89a7c9108
SHA160cde78a74e4943f349f1999be3b6fc3c19ab268
SHA256d7f214dc55857c3576675279261a0ee1881f7ddee4755bb0b9e7566fc0f425a9
SHA51235f3741538bd59f6c744bcad6f348f4eb6ea1ee542f9780daa29de5dbb2d772b01fe4774fb1c2c7199a349488be309ceedd562ceb5f1bdcdd563036b301dcd9f
-
Filesize
146KB
MD5d9a290f7aec8aff3591c189b3cf8610a
SHA17558d29fb32018897c25e0ac1c86084116f1956c
SHA25641bed95cb1101181a97460e2395efebb0594849e6f48b80a2b7c376ddf5ce0ea
SHA512b55ab687a75c11ba99c64be42ad8471576aa2df10ce1bb61e902e98827e3a38cd922e365751bd485cac089c2bd8bccf939a578da7238506b77fe02a3eb7994c6
-
Filesize
473KB
MD55d881df1fc70b133aa7d0a57d5c18109
SHA1c2b6649f9abd5a779e540c6055e16de04795cdf4
SHA25654974563c688cd0005c9fea093ee6489364263ce67227e2d9c76952b542c644b
SHA51228cca31a4d49afef090d284cb60fa0ac0d8122a92cbc32ff333a661e53952425fb410deb7296bbb245443e16ecce5b1e3759e53acc83e323dc155cc13bba4a06
-
Filesize
198KB
MD57429ce42ac211cd3aa986faad186cedd
SHA1b61a57f0f99cfd702be0fbafcb77e9f911223fac
SHA256d608c05409ac4bd05d8e0702fcf66dfae5f4f38cbae13406842fa5504f4d616f
SHA512ee4456877d6d881d9904013aabecb9f2daf6fc0ec7a7c9251e77396b66a7f5a577fe8544e64e2bb7464db429db56a3fe47c183a81d40cc869d01be573ab5e4c1
-
Filesize
201KB
MD5c7f7803a2032d0d942340cfebba0a42c
SHA1578062d0707e753ab58875fb3a52c23e6fe2adf6
SHA2560f201a8142c5a8adc36d2a177dd8d430eef2b05cff0e4faefb52440e823b54bb
SHA51248e3e1eb3a33c1b8c20411209d8ed261c00798393f5fdd691d3fa0abed2849d8eb241bedcbeefddfebbec292c7abd254023e25df77c85b46000fe63a7324172b
-
Filesize
244KB
MD5da18586b25e72ff40c0f24da690a2edc
SHA127a388f3cdcfa7357f971b5c4411ea5aa1b9e5f5
SHA25667f6e8f14bcf0e6d570c1f4ac5a1bb80a4e1470b5bad5a7ee85689c476597d8e
SHA5123512820a9d37b61f77a79b2d4d3f6aec9ef53dbf81071bee16f5dcc8173393a1cd1bffe9f7f39467b72f9c9271a78e42078e68598934188d9df0b887f2edc5ab
-
Filesize
290KB
MD523b1708cd5e7409832fe36f125844e7a
SHA139ec7d4322cf4ccea82ee65343d05459c5eb3f3e
SHA25603e0297166fcd0b5a439d974080fbd5efbb48dfe3b019ab11faa89ecc372765f
SHA512d6291f0a98f1dfedd81589f07d219df23a9e734680975d5e2d91553767927bd2b7ed915e6f5974767277fb813e14f8549caf57f96912ea3cebe28b73ca3ec62e
-
Filesize
3.6MB
MD5c0ac85794f04cb1648989075e6dfa55c
SHA1c4e2ae9b72b40cd2eca4a178400c3832ad1df89e
SHA256a62f88cb577ffe115d6b712dc4c559d5b9852f055ebbab092fda223b5e0dd046
SHA512ef2f2a9b04e20a0dc7f5f088119d0f6e32801948e11f7f7a05e1e80c0e4313b6faa2527e4e8f15f878219e593ee0afc8350ade9094beae4a0c1f5107e2cf6a15
-
Filesize
1.6MB
MD511486d1d22eaacf01580e3e650f1da3f
SHA1a47a721efec08ade8456a6918c3de413a2f8c7a2
SHA2565e1b1daa9968ca19a58714617b7e691b6b6f34bfacaf0dcf4792c48888b1a5d3
SHA5125bd54e1c1308e04a769e089ab37bd9236ab97343b486b85a018f2c8ad060503c97e8bc51f911a63f9b96dd734eb7d21e0a5c447951246d972b05fafeef4633da
-
Filesize
1.1MB
MD55c78384d8eb1f6cb8cb23d515cfe7c98
SHA1b732ab6c3fbf2ded8a4d6c8962554d119f59082e
SHA2569abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
SHA51299324af5f8fb70a9d01f97d845a4c6999053d6567ba5b80830a843a1634b02eaf3c0c04ced924cf1b1be9b4d1dbbcb95538385f7f85ad84d3eaaa6dcdebcc8a6
-
Filesize
274KB
MD5d84f63a0bf5eff0c8c491f69b81d1a36
SHA117c7d7ae90e571e99f1b1685872f91c04ee76e85
SHA25606d363997722b0e3c4787f72ca61cb2a8ad59ea7ba8a9d14eafa8a8a550687a2
SHA512865aab84cfe40604ffd013d8517a538eb1322b90372d236821c0e39e285a20bdad755ddff8d59d8af47a9b10b6c77947abc9148761e75892c617db8503b0ef6e
-
Filesize
485KB
MD586749cd13537a694795be5d87ef7106d
SHA1538030845680a8be8219618daee29e368dc1e06c
SHA2568c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
SHA5127b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c
-
Filesize
650KB
MD52f826daacb184077b67aad3fe30e3413
SHA1981d415fe70414aaac3a11024e65ae2e949aced8
SHA256a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222
SHA5122a6d9bdf4b7be9b766008e522cbb2c21921ba55d84dfde653ca977f70639e342a9d5548768de29ae2a85031c11dac2ae4b3c76b9136c020a6e7c9a9a5879caeb
-
Filesize
534KB
MD58a403bc371b84920c641afa3cf9fef2f
SHA1d6c9d38f3e571b54132dd7ee31a169c683abfd63
SHA256614a701b90739e7dbf66b14fbdb6854394290030cc87bbcb3f47e1c45d1f06c3
SHA512b376ef1f49b793a8cd8b7af587f538cf87cb2fffa70fc144e1d1b7e2e8e365ba4ad0568321a0b1c04e69b4b8b694d77e812597a66be1c59eda626cbf132e2c72
-
Filesize
6.7MB
MD563dc05e27a0b43bf25f151751b481b8c
SHA1b20321483dac62bce0aa0cef1d193d247747e189
SHA2567d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
SHA512374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3
-
Filesize
674KB
MD597510a7d9bf0811a6ea89fad85a9f3f3
SHA12ac0c49b66a92789be65580a38ae9798237711db
SHA256c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA5122a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb
-
Filesize
674KB
MD59c10a5ec52c145d340df7eafdb69c478
SHA157f3d99e41d123ad5f185fc21454367a7285db42
SHA256ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
SHA5122704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f
-
Filesize
536KB
MD5be885b2a881f00dfb801afd8c4f8b0e4
SHA1b8b8f6ed9aea73e7aa171d6c2bc3865333152030
SHA256efaab0fbd8998d6c25f4073e76482c01f60b64bd015b11f18893283762ef44d6
SHA512f5066b84b731022592d7a1d762f7501d6d25b94ca22ac6e8bde42de06fd2e9f2354f0d2c5a415ea10507ac304d7b89da85a8cb311c0a07c7b8f1dfd96cd6a2fa
-
Filesize
650KB
MD5558fdb0b9f097118b0c928bb6062370a
SHA1ad971a9a4cac3112a494a167e1b7736dcd6718b3
SHA25690cee4a89cc1401ac464818226b7df69aa930804cefce56758d4e2ea0009d924
SHA5125d08d5428e82fb3dad55c19e2c029de8f16e121faac87575b97f468b0ec312b3e0696225546cba91addaaf8f2451d44ae6386b4e4f7f621ce45055f3be797d7c
-
Filesize
485KB
MD587f15006aea3b4433e226882a56f188d
SHA1e3ad6beb8229af62b0824151dbf546c0506d4f65
SHA2568d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
SHA512b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1
-
Filesize
691KB
MD5bdcc4b493753298275c453c6edc93e19
SHA1dd0bdf5e996808d2e6de46551e7709482984c40c
SHA25613e5b58fe047df19aecb0823111e2c04ac8ae2106f865c1b3af979bbc0b9cecc
SHA5124bbba6af80aa2211a1b86cc3f6571f01a294dd0f8e8e4542029d7289cd21137f4c4dff840cf79839e12b083063d2db6b74a175123746c38bf08695b2843ae458
-
Filesize
495KB
MD507e194ce831b1846111eb6c8b176c86e
SHA1b9c83ec3b0949cb661878fb1a8b43a073e15baf1
SHA256d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
SHA51255f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5
-
Filesize
293KB
MD5f3228c24035b3f54f78bb4fd11c36aeb
SHA12fe73d1f64575bc4abf1d47a9dddfe7e2d9c9cbb
SHA256d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7
SHA512b526c63338d9167060bc40ffa1d13a8c2e871f46680cd4a0efc2333d9f15bf21ae75af45f8932de857678c5bf785011a28862ce7879f4bffdb9753c8bc2c19b5
-
Filesize
195KB
MD53fe4432f457ba9b0b99d6922de2bdbb9
SHA131bef418a04a951412f28a9a46202bcc679085e5
SHA2561906b7b9f548afea19fc38eee37248be4656dbdd8a5fe37f78d9587cbb61e683
SHA512f9c50a0361482fb4a3a1fca86ee1b72427dc31cd876849e39b3a76f85785c2eb62a18696c384bd81b57681a012f916a9cacba83f740a78b7221c891bb6f893b3
-
Filesize
8B
MD54b6e985cfb30d84c08b5127dff3efa7e
SHA16578bf9b4874f587c7951843d4d0fb7c8b48f820
SHA25636c48b0b35e8add760bade4f121467940a86810bf9ec77afba96fd0a92b95201
SHA512f2322156d2c94263a3013abbf79b5671c56b9dcdc8bc315853359cbc89c640f9ecc55f0bb97a4dd5916e1f395b223191208fe2efe2de720d786550b72cbc8e38
-
Filesize
235KB
MD5f88cae88bfeb942f5aee73584bc19fe1
SHA1afba079c5264c9c04fcb6d94b68c1b6b28b38dd7
SHA25695dcc64cff82520063679011ad47a05ae8067d096737097165259f5eb59e864d
SHA51202732114c65713b9678103ff6d8400d6c9f075d799c14520a183098eb5043834390d90e48f19521ff8f7b58be33315d72f1712733c93f23d836caad70e30b00b
-
Filesize
129B
MD57ea657c84536238e2f4ce92b1ae3bd26
SHA12e479fbdf0f3142696d032ab9e60fb146a9b5e28
SHA2566bff78507caa62f3e7a6ab0e332bb463307d14db245d0faf98fe39b32150dde8
SHA51235dbc9c24fdb3ea8291add44921f74263f004e56677e885711996ac5d31a77a179baad0506bf4ea7b5223c42fe1080589669d26374c5857d814a7f5c0630fc85
-
Filesize
40KB
MD5e98eaf745be5c638c0273bdf5535c9de
SHA1aa09f250899b1b56144d2b8fa92d091ae53b3f96
SHA2569782abec73716aec140bc8df64d014a93f1ffdb2e88a878ce81ffd6adaadd4f2
SHA512ba9a0eb140ded6561be35ebc987937e587a9b8ad76793d418cc4e4eaa7112a1619b6c8c3e395c352dd688ce905d5410c736e3b39d052c3d50ef8bdf76acd7f4a
-
Filesize
108KB
-
Filesize
660KB
-
Filesize
660KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
660KB
-
Filesize
660KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
684KB
-
Filesize
684KB