Analysis
-
max time kernel
140s -
max time network
104s -
platform
windows11-21h2_x64 -
resource
win11-20250619-en -
resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/07/2025, 18:33
Behavioral task
behavioral1
Sample
JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
Resource
win11-20250619-en
General
-
Target
JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe
-
Size
324KB
-
MD5
1c7b87a86e209ced0b42c82a724585d0
-
SHA1
0257adfad4c9f9300b3439194fe6163c6bc0a0bc
-
SHA256
c801b16f7810c2f64c12f4d3c5c0c7605dae4b467415e4ca1e7dba5f158bfbcb
-
SHA512
9c4f0880b08dd36a5ab332c50e3d925a7f562e1bc112742fb7b5426a9ae002e55a5602945d6b2c58df9bb06db9a7c5570d5a4f243a18793bb7dfcdafe4a1b770
-
SSDEEP
6144:/OXg0h5CnS2PF9YTjGF2gEY0BETmagWyvYG9sfLn4MnYE9:/WNziS2TYTqF2gDZKaznnxnYy
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2600 2FmiSbkLHUt3AVy.exe 1892 CTS.exe 5552 CTS.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
resource yara_rule behavioral2/memory/1496-0-0x0000000001000000-0x0000000001017000-memory.dmp upx behavioral2/files/0x001a00000002b0d5-8.dat upx behavioral2/memory/1892-9-0x0000000000410000-0x0000000000427000-memory.dmp upx behavioral2/memory/1496-10-0x0000000001000000-0x0000000001017000-memory.dmp upx behavioral2/memory/5552-14-0x0000000000410000-0x0000000000427000-memory.dmp upx behavioral2/memory/5552-16-0x0000000000410000-0x0000000000427000-memory.dmp upx behavioral2/files/0x001d00000002afd1-17.dat upx behavioral2/memory/1892-34-0x0000000000410000-0x0000000000427000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CTS.exe JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTS.exe -
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open\command 2FmiSbkLHUt3AVy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell 2FmiSbkLHUt3AVy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open 2FmiSbkLHUt3AVy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2FMISB~1.EXE \"%1\"" 2FmiSbkLHUt3AVy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.GRF 2FmiSbkLHUt3AVy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.GRF\ = "GraphEdtGraph" 2FmiSbkLHUt3AVy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph 2FmiSbkLHUt3AVy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\ = "Filter Graph" 2FmiSbkLHUt3AVy.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1496 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe Token: SeDebugPrivilege 1892 CTS.exe Token: SeDebugPrivilege 5552 CTS.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2600 2FmiSbkLHUt3AVy.exe 2600 2FmiSbkLHUt3AVy.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2600 1496 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 77 PID 1496 wrote to memory of 2600 1496 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 77 PID 1496 wrote to memory of 1892 1496 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 79 PID 1496 wrote to memory of 1892 1496 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 79 PID 1496 wrote to memory of 1892 1496 JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe 79 PID 5748 wrote to memory of 5552 5748 cmd.exe 81 PID 5748 wrote to memory of 5552 5748 cmd.exe 81 PID 5748 wrote to memory of 5552 5748 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c7b87a86e209ced0b42c82a724585d0.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2FmiSbkLHUt3AVy.exeC:\Users\Admin\AppData\Local\Temp\2FmiSbkLHUt3AVy.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2600
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\CTS.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\CTS.exeC:\Windows\CTS.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5552
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
358KB
MD5a7accea7832038c7b0571592585966e7
SHA1e86ca9f7c67166af8376713d456d8b9b60844039
SHA2568ebfd8ffd5ce56d662a52a7cbb1e06261761c990b676e32f42c3b82ed678e34f
SHA512b9c833224e207bf38459225c505a71f7e463983e923fc52b74adc78a6caf833c584f4d8a64aafb7dc9310e8724b2a343a8603f63143bf46e6cdbd51dee3b2b47
-
Filesize
288KB
MD5880e155f8f47fb0db7b2080e71d59568
SHA12ed0c0f809765bbabd8c7d4f58e9a0bacf2bb629
SHA2566011cd7d1a314d109bc0755d17be2e7812b2f5542ec24f3f3023532c1e8a1d44
SHA51270977d36b8ec8c271c5ffd3303677743a2626196bb62af5d817e86a7eeed972bbb70acdd81508f7b4ee1da366ce02cd96a8d0e6f11627842f195cfd0c53a5bec
-
Filesize
35KB
MD593e5f18caebd8d4a2c893e40e5f38232
SHA1fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6
SHA256a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8
SHA512986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54