Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 16:20
Static task
static1
Behavioral task
behavioral1
Sample
4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe
-
Size
201KB
-
MD5
4bf758a65fe7dc8f879571f9bf5faf1b
-
SHA1
dc8898166de5788b9573833378af95c774f66dc6
-
SHA256
60227c61219bfba2a397ff898e998e41bea302741edf2e6b68a5a389302c43ef
-
SHA512
60872aacc14b5ea6bbdcc10039e9b016aa82cedd844d7c39c61ec4e4c2d07e36dfb6b0ab9ea619da3ba0c4cc141adac62a85d83a46b44e68d942ba10774bb4d5
-
SSDEEP
6144:jXwU1iLEG7znkvOc009BbnUBah3nafO80Ha1:L1OEhOUBbn7Y1
Malware Config
Signatures
-
Taurus Stealer payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2364-3-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2364-2-0x0000000000220000-0x0000000000255000-memory.dmp family_taurus_stealer behavioral1/memory/2364-4-0x0000000000400000-0x0000000000F8F000-memory.dmp family_taurus_stealer behavioral1/memory/2364-7-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2364-9-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2364-8-0x0000000000400000-0x0000000000F8F000-memory.dmp family_taurus_stealer -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3036 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2464 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.execmd.exedescription pid process target process PID 2364 wrote to memory of 3036 2364 4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe cmd.exe PID 2364 wrote to memory of 3036 2364 4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe cmd.exe PID 2364 wrote to memory of 3036 2364 4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe cmd.exe PID 2364 wrote to memory of 3036 2364 4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe cmd.exe PID 3036 wrote to memory of 2464 3036 cmd.exe timeout.exe PID 3036 wrote to memory of 2464 3036 cmd.exe timeout.exe PID 3036 wrote to memory of 2464 3036 cmd.exe timeout.exe PID 3036 wrote to memory of 2464 3036 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2364-1-0x0000000001100000-0x0000000001200000-memory.dmpFilesize
1024KB
-
memory/2364-3-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2364-2-0x0000000000220000-0x0000000000255000-memory.dmpFilesize
212KB
-
memory/2364-4-0x0000000000400000-0x0000000000F8F000-memory.dmpFilesize
11.6MB
-
memory/2364-5-0x0000000001100000-0x0000000001200000-memory.dmpFilesize
1024KB
-
memory/2364-7-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2364-10-0x0000000001100000-0x0000000001200000-memory.dmpFilesize
1024KB
-
memory/2364-9-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2364-8-0x0000000000400000-0x0000000000F8F000-memory.dmpFilesize
11.6MB