Analysis
-
max time kernel
137s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 16:20
Static task
static1
Behavioral task
behavioral1
Sample
4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe
-
Size
201KB
-
MD5
4bf758a65fe7dc8f879571f9bf5faf1b
-
SHA1
dc8898166de5788b9573833378af95c774f66dc6
-
SHA256
60227c61219bfba2a397ff898e998e41bea302741edf2e6b68a5a389302c43ef
-
SHA512
60872aacc14b5ea6bbdcc10039e9b016aa82cedd844d7c39c61ec4e4c2d07e36dfb6b0ab9ea619da3ba0c4cc141adac62a85d83a46b44e68d942ba10774bb4d5
-
SSDEEP
6144:jXwU1iLEG7znkvOc009BbnUBah3nafO80Ha1:L1OEhOUBbn7Y1
Malware Config
Signatures
-
Taurus Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3864-3-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/3864-2-0x00000000001C0000-0x00000000001F5000-memory.dmp family_taurus_stealer behavioral2/memory/3864-5-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/3864-4-0x0000000000400000-0x0000000000F8F000-memory.dmp family_taurus_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3396 timeout.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.execmd.exedescription pid process target process PID 3864 wrote to memory of 1332 3864 4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe cmd.exe PID 3864 wrote to memory of 1332 3864 4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe cmd.exe PID 3864 wrote to memory of 1332 3864 4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe cmd.exe PID 1332 wrote to memory of 3396 1332 cmd.exe timeout.exe PID 1332 wrote to memory of 3396 1332 cmd.exe timeout.exe PID 1332 wrote to memory of 3396 1332 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\4bf758a65fe7dc8f879571f9bf5faf1b_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3864-1-0x0000000000FE0000-0x00000000010E0000-memory.dmpFilesize
1024KB
-
memory/3864-3-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3864-2-0x00000000001C0000-0x00000000001F5000-memory.dmpFilesize
212KB
-
memory/3864-5-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3864-4-0x0000000000400000-0x0000000000F8F000-memory.dmpFilesize
11.6MB