Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 18:33
Behavioral task
behavioral1
Sample
JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
Resource
win11-20250619-en
General
-
Target
JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
-
Size
324KB
-
MD5
1c7b87a86e209ced0b42c82a724585d0
-
SHA1
0257adfad4c9f9300b3439194fe6163c6bc0a0bc
-
SHA256
c801b16f7810c2f64c12f4d3c5c0c7605dae4b467415e4ca1e7dba5f158bfbcb
-
SHA512
9c4f0880b08dd36a5ab332c50e3d925a7f562e1bc112742fb7b5426a9ae002e55a5602945d6b2c58df9bb06db9a7c5570d5a4f243a18793bb7dfcdafe4a1b770
-
SSDEEP
6144:/OXg0h5CnS2PF9YTjGF2gEY0BETmagWyvYG9sfLn4MnYE9:/WNziS2TYTqF2gDZKaznnxnYy
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 6140 cTe1DpEf3WbwHfw.exe 4464 CTS.exe 3168 CTS.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
resource yara_rule behavioral1/memory/5708-0-0x0000000000FE0000-0x0000000000FF7000-memory.dmp upx behavioral1/memory/5708-10-0x0000000000FE0000-0x0000000000FF7000-memory.dmp upx behavioral1/memory/4464-11-0x0000000000C40000-0x0000000000C57000-memory.dmp upx behavioral1/files/0x0008000000024163-8.dat upx behavioral1/files/0x0005000000021558-14.dat upx behavioral1/memory/3168-26-0x0000000000C40000-0x0000000000C57000-memory.dmp upx behavioral1/memory/3168-31-0x0000000000C40000-0x0000000000C57000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CTS.exe JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTS.exe -
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph cTe1DpEf3WbwHfw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\ = "Filter Graph" cTe1DpEf3WbwHfw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open\command cTe1DpEf3WbwHfw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell cTe1DpEf3WbwHfw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open cTe1DpEf3WbwHfw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CTE1DP~1.EXE \"%1\"" cTe1DpEf3WbwHfw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.GRF cTe1DpEf3WbwHfw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.GRF\ = "GraphEdtGraph" cTe1DpEf3WbwHfw.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5708 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe Token: SeDebugPrivilege 4464 CTS.exe Token: SeDebugPrivilege 3168 CTS.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6140 cTe1DpEf3WbwHfw.exe 6140 cTe1DpEf3WbwHfw.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5708 wrote to memory of 6140 5708 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 86 PID 5708 wrote to memory of 6140 5708 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 86 PID 5708 wrote to memory of 4464 5708 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 88 PID 5708 wrote to memory of 4464 5708 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 88 PID 5708 wrote to memory of 4464 5708 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 88 PID 2192 wrote to memory of 3168 2192 cmd.exe 90 PID 2192 wrote to memory of 3168 2192 cmd.exe 90 PID 2192 wrote to memory of 3168 2192 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\cTe1DpEf3WbwHfw.exeC:\Users\Admin\AppData\Local\Temp\cTe1DpEf3WbwHfw.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6140
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\CTS.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\CTS.exeC:\Windows\CTS.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5175939af136e5d768c599a0784335bba
SHA1a024c1a91561b76af6238560108c10e205a60df9
SHA25630d5680e89805bff2a8abfca93ce52e195c0bdc88b562b94e0c87300177b1932
SHA51257ba6b6e08fe3edeb1217f7d4ffa9d603d0b28d84f6e0fce935f48f63ee08170532e77d9ecea0e267c905ece6f0b24c1e0a56cd50ac62ffc6123d2f434a068ce
-
Filesize
288KB
MD5880e155f8f47fb0db7b2080e71d59568
SHA12ed0c0f809765bbabd8c7d4f58e9a0bacf2bb629
SHA2566011cd7d1a314d109bc0755d17be2e7812b2f5542ec24f3f3023532c1e8a1d44
SHA51270977d36b8ec8c271c5ffd3303677743a2626196bb62af5d817e86a7eeed972bbb70acdd81508f7b4ee1da366ce02cd96a8d0e6f11627842f195cfd0c53a5bec
-
Filesize
35KB
MD593e5f18caebd8d4a2c893e40e5f38232
SHA1fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6
SHA256a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8
SHA512986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54