Analysis

  • max time kernel
    140s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 18:33

General

  • Target

    JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe

  • Size

    324KB

  • MD5

    1c7b87a86e209ced0b42c82a724585d0

  • SHA1

    0257adfad4c9f9300b3439194fe6163c6bc0a0bc

  • SHA256

    c801b16f7810c2f64c12f4d3c5c0c7605dae4b467415e4ca1e7dba5f158bfbcb

  • SHA512

    9c4f0880b08dd36a5ab332c50e3d925a7f562e1bc112742fb7b5426a9ae002e55a5602945d6b2c58df9bb06db9a7c5570d5a4f243a18793bb7dfcdafe4a1b770

  • SSDEEP

    6144:/OXg0h5CnS2PF9YTjGF2gEY0BETmagWyvYG9sfLn4MnYE9:/WNziS2TYTqF2gDZKaznnxnYy

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5708
    • C:\Users\Admin\AppData\Local\Temp\cTe1DpEf3WbwHfw.exe
      C:\Users\Admin\AppData\Local\Temp\cTe1DpEf3WbwHfw.exe
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6140
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4464
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\CTS.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\CTS.exe
      C:\Windows\CTS.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3168

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          37KB

          MD5

          175939af136e5d768c599a0784335bba

          SHA1

          a024c1a91561b76af6238560108c10e205a60df9

          SHA256

          30d5680e89805bff2a8abfca93ce52e195c0bdc88b562b94e0c87300177b1932

          SHA512

          57ba6b6e08fe3edeb1217f7d4ffa9d603d0b28d84f6e0fce935f48f63ee08170532e77d9ecea0e267c905ece6f0b24c1e0a56cd50ac62ffc6123d2f434a068ce

        • C:\Users\Admin\AppData\Local\Temp\cTe1DpEf3WbwHfw.exe

          Filesize

          288KB

          MD5

          880e155f8f47fb0db7b2080e71d59568

          SHA1

          2ed0c0f809765bbabd8c7d4f58e9a0bacf2bb629

          SHA256

          6011cd7d1a314d109bc0755d17be2e7812b2f5542ec24f3f3023532c1e8a1d44

          SHA512

          70977d36b8ec8c271c5ffd3303677743a2626196bb62af5d817e86a7eeed972bbb70acdd81508f7b4ee1da366ce02cd96a8d0e6f11627842f195cfd0c53a5bec

        • C:\Windows\CTS.exe

          Filesize

          35KB

          MD5

          93e5f18caebd8d4a2c893e40e5f38232

          SHA1

          fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6

          SHA256

          a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8

          SHA512

          986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54

        • memory/3168-26-0x0000000000C40000-0x0000000000C57000-memory.dmp

          Filesize

          92KB

        • memory/3168-31-0x0000000000C40000-0x0000000000C57000-memory.dmp

          Filesize

          92KB

        • memory/4464-11-0x0000000000C40000-0x0000000000C57000-memory.dmp

          Filesize

          92KB

        • memory/5708-0-0x0000000000FE0000-0x0000000000FF7000-memory.dmp

          Filesize

          92KB

        • memory/5708-10-0x0000000000FE0000-0x0000000000FF7000-memory.dmp

          Filesize

          92KB