Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
19/01/2025, 11:20
General
- Target JaffaCakes118_c64452b41729eb9b646bc1b9d44a047b.exe
- Size 441KB
- Sample250119-nfd3bawjer
- SHA256 1a6a39782eb661fb979d73b2da6705a8de60a3bad87bb0c976b8c18b4130e4a4
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 31 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- NSIS installer 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c64452b41729eb9b646bc1b9d44a047b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c64452b41729eb9b646bc1b9d44a047b.exe"1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nst8E76.tmp\DualStub.exeC:\Users\Admin\AppData\Local\Temp\nst8E76.tmp\DualStub.exe ~URL Parts Error~~~~URL Parts Error~URL Parts Error~~#~726~5081~~URL Parts Error~~SendRequest Error~C6-70-90-DD-15-99~#2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 12922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4812 -ip 48121⤵
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
BrandingURL.dll
DualStub.exe
FindProcDLL.dll
GetVersion.dll
Math.dll
System.dll
UserInfo.dll
intlib.dll
nsDialogs.dll
registry.dll
memory/4812-55-0x00000000032E0000-0x00000000032FA000-memory.dmp
memory/4812-87-0x0000000003401000-0x0000000003402000-memory.dmp
memory/4812-86-0x0000000003400000-0x0000000003403000-memory.dmp