Analysis

  • max time kernel
    121s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/07/2025, 17:32

General

  • Target

    JaffaCakes118_1c7039ad3300c33937a4dbace449d68d.exe

  • Size

    657KB

  • MD5

    1c7039ad3300c33937a4dbace449d68d

  • SHA1

    124e5c68f868e9f337e2f891138b1ec5dd0f690e

  • SHA256

    7cba5943a26d2978cfe40816315127064ba477ec76bfc7306a6075ab021a6218

  • SHA512

    8be1f6dff7034c232f6c7ce5fc3f026916962cb8c5e6eaa6cc38b5a6f079e92038c1bcabdb64aa9e7ecb2e41f5103e4649b88af2807f79d99ebe0ebc687a44e7

  • SSDEEP

    12288:HPMOAsnoQ3G4GQTq4OaQQTYJ8eP4/L5uO7D3f5Blq4ma/QTkJ8ePJ/R5uO7nU26/:HP0qoQG4GQm4OaHYJ8eP4D5uOHBBo4m/

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7039ad3300c33937a4dbace449d68d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7039ad3300c33937a4dbace449d68d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 "C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release2984\ie\RichMediaViewV1release2984.dll" /s
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:5484
    • C:\Windows\SysWOW64\gpupdate.exe
      "C:\Windows\System32\gpupdate.exe" /force
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5004
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:3376
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:5292

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release2984\ie\RichMediaViewV1release2984.dll

              Filesize

              85KB

              MD5

              ea0eb71b283758d746896255bb91a35a

              SHA1

              3ea49116a5fc20de6ebd480e55b709f366a9ba50

              SHA256

              6a951bc2332458d71b5a47284de8bf8407758025932f61dcb9f168ef4080a49e

              SHA512

              2866908d432132082a1a337649a930eb5a9fea1cd9e289eb22521d0fd080db6e98565f4225b18684193897cccf5b35bfbd5106a30b584f89b3a16214c252520b

            • C:\Users\Admin\AppData\Local\Temp\nsuB7E7.tmp\aminsis.dll

              Filesize

              567KB

              MD5

              450753ad96785a240a39deccab3af0d0

              SHA1

              21c544064d2ffa6444508268ce258a330d459fc5

              SHA256

              1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

              SHA512

              c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab