Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-01-2025 00:22
General
-
Target
JaffaCakes118_7f0b3b81f856314a816f0c1e193af71d.exe
-
Size
2.6MB
-
MD5
7f0b3b81f856314a816f0c1e193af71d
-
SHA1
a84a152c5211a1f801e868e56f02ff9be52008ef
-
SHA256
cf22bf743239104d52d195763f989fb579de4299a44eaef60ca5c72b6778a8fe
-
SHA512
7b5755e36bce09906e84d3866e3af5a721db95e79052a143fecd33b77e2b0c8475b81a6d0fca2063d9a03a33a090c9f85ccee605c9fc6b0f76668327f214c52b
-
SSDEEP
49152:DRcQaZCpd/o5JYLYXzuG5oXb0rm1bkcI1zLxWSdSL5LyHS7PlVn:DRcpZUSTYezPor0rmtmLfSL5+SLlZ
Malware Config
Extracted
cryptbot
veorfg11.top
morysl01.top
-
payload_url
http://tyngle01.top/download.php?file=lv.exe
Signatures
-
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
-
Cryptbot family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 21 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7f0b3b81f856314a816f0c1e193af71d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7f0b3b81f856314a816f0c1e193af71d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
347KB
MD5aa7551bb436f1d20b8cfdb1e2744ee24
SHA1bc1cca451fe2d992d36285d3a3848a0ddf5433aa
SHA25654221352307eac982d8c7c170b0a46b06edde326e8cdefa990ea3ab098ca3159
SHA512efc4abb962dc54525d6659b3419266f442dbb826726420fa907d777e578d19622db2410f09a97b31ec64fa5f49baed8048685884038b52edab96e6e68bda2e1d
-
Filesize
7KB
MD55de37ddcebc94d1c83ac5d89b1aaa84d
SHA1802ea6c786d2a6870d10b60cd07d07e15bea4d8f
SHA256f66672a83006b2e046c7ee2667abf38e428eaca465e7e72d643e5ad61cf38eb8
SHA5126eb215baa5e09af7b2667a3a4009b9b99b4ce2638096eefcfb8d77213976b6b0d320df1d363bae46cf5d1285ec404c0d9c011332bdc1a013ce6701ba2e65e85a
-
Filesize
56KB
MD55e5e7a9e5a0e603271a87de403efad7f
SHA1b972565abee04f6d0e58f540f2cca1d70863be40
SHA256c4f5cb3ca125403747ffafd9bf5bcea24b78b7755b09e873b2b7b0550b5c9764
SHA5124c21e2663fc0c355430cc6ecd0ae4f9eadceab74f06f8a1301ece17018cd4325d83bfe377c18c0a68e92a5a8915b3b679922191630615758495b7eb825599301
-
Filesize
398KB
MD56f6bae1f06c80652917e155fa6ca3339
SHA145a7e5c7bd1c3863562a3ac667dc9086109c9c90
SHA256b18e98ab70f47e6e80af50a56cbc7ab985ca1c12ce0d9c7ec816d5a6ecb98cd0
SHA512ff9efc73f617764b2cb652b561627a4b9ee5a1438dea4bf1c8d6d02e99cff82a1cb4882cb8724132ce388d2ff930511cddc35ef79dd517867bda08bc71caf599
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
