Analysis

  • max time kernel
    140s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/07/2025, 18:33

General

  • Target

    JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe

  • Size

    324KB

  • MD5

    1c7b87a86e209ced0b42c82a724585d0

  • SHA1

    0257adfad4c9f9300b3439194fe6163c6bc0a0bc

  • SHA256

    c801b16f7810c2f64c12f4d3c5c0c7605dae4b467415e4ca1e7dba5f158bfbcb

  • SHA512

    9c4f0880b08dd36a5ab332c50e3d925a7f562e1bc112742fb7b5426a9ae002e55a5602945d6b2c58df9bb06db9a7c5570d5a4f243a18793bb7dfcdafe4a1b770

  • SSDEEP

    6144:/OXg0h5CnS2PF9YTjGF2gEY0BETmagWyvYG9sfLn4MnYE9:/WNziS2TYTqF2gDZKaznnxnYy

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Users\Admin\AppData\Local\Temp\2FmiSbkLHUt3AVy.exe
      C:\Users\Admin\AppData\Local\Temp\2FmiSbkLHUt3AVy.exe
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2600
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1892
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\CTS.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5748
    • C:\Windows\CTS.exe
      C:\Windows\CTS.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:5552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

          Filesize

          358KB

          MD5

          a7accea7832038c7b0571592585966e7

          SHA1

          e86ca9f7c67166af8376713d456d8b9b60844039

          SHA256

          8ebfd8ffd5ce56d662a52a7cbb1e06261761c990b676e32f42c3b82ed678e34f

          SHA512

          b9c833224e207bf38459225c505a71f7e463983e923fc52b74adc78a6caf833c584f4d8a64aafb7dc9310e8724b2a343a8603f63143bf46e6cdbd51dee3b2b47

        • C:\Users\Admin\AppData\Local\Temp\2FmiSbkLHUt3AVy.exe

          Filesize

          288KB

          MD5

          880e155f8f47fb0db7b2080e71d59568

          SHA1

          2ed0c0f809765bbabd8c7d4f58e9a0bacf2bb629

          SHA256

          6011cd7d1a314d109bc0755d17be2e7812b2f5542ec24f3f3023532c1e8a1d44

          SHA512

          70977d36b8ec8c271c5ffd3303677743a2626196bb62af5d817e86a7eeed972bbb70acdd81508f7b4ee1da366ce02cd96a8d0e6f11627842f195cfd0c53a5bec

        • C:\Windows\CTS.exe

          Filesize

          35KB

          MD5

          93e5f18caebd8d4a2c893e40e5f38232

          SHA1

          fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6

          SHA256

          a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8

          SHA512

          986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54

        • memory/1496-0-0x0000000001000000-0x0000000001017000-memory.dmp

          Filesize

          92KB

        • memory/1496-10-0x0000000001000000-0x0000000001017000-memory.dmp

          Filesize

          92KB

        • memory/1892-9-0x0000000000410000-0x0000000000427000-memory.dmp

          Filesize

          92KB

        • memory/1892-34-0x0000000000410000-0x0000000000427000-memory.dmp

          Filesize

          92KB

        • memory/5552-14-0x0000000000410000-0x0000000000427000-memory.dmp

          Filesize

          92KB

        • memory/5552-16-0x0000000000410000-0x0000000000427000-memory.dmp

          Filesize

          92KB