Analysis
- max time kernel
93s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/01/2025, 14:06
General
- Target JaffaCakes118_ea73246dff9c6681c6919f1f85660985.exe
- Size 43KB
- Sample250120-reffjasqeq
- SHA256 2ea5aa919136598be99adbda6ad5b1b0389d701728132fb9f38a05cc32ce4bdb
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ea73246dff9c6681c6919f1f85660985.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ea73246dff9c6681c6919f1f85660985.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.batC:\Users\Admin\AppData\Local\Temp\svchost.bat2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.bat
memory/812-11-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/812-2-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/812-4-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/812-3-0x000000001BCF0000-0x000000001C1BE000-memory.dmp
memory/812-5-0x000000001C260000-0x000000001C2FC000-memory.dmp
memory/812-6-0x0000000000FE0000-0x0000000000FE8000-memory.dmp
memory/812-7-0x000000001C400000-0x000000001C44C000-memory.dmp
memory/812-8-0x000000001C4B0000-0x000000001C510000-memory.dmp
memory/812-0-0x00007FFEF1145000-0x00007FFEF1146000-memory.dmp
memory/812-9-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/812-23-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/812-1-0x000000001B770000-0x000000001B816000-memory.dmp
memory/1692-19-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/1692-20-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/1692-21-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/1692-25-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/1692-24-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/1692-29-0x000000001D190000-0x000000001D1A9000-memory.dmp
memory/1692-30-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp
memory/1692-31-0x00007FFEF0E90000-0x00007FFEF1831000-memory.dmp