Analysis
-
max time kernel
141s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 12:33
Static task
static1
Behavioral task
behavioral1
Sample
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe
-
Size
806KB
-
MD5
05332d194f758eae4b12ddda44c7dcda
-
SHA1
f4adabb9f3650c4d4f1b713f00cf60dda1134cc3
-
SHA256
5671f534a875a0e788b94fe86518fff5cd713d8df079877a319652274aa68fa0
-
SHA512
b7129b6cfdbc23887bef311709920b1672118c61ada6ca410c2a8c3d7765ef04b39df1d98341dbec829e02dde9627f591a9b06ef53cc3d3305d86c23f7647494
-
SSDEEP
12288:xvmIXWFDiG5FFLbbMvVEbbU4NYLsI68Y/EDlfR+k7SDCMKcaPnOz:A5XbMibnisIvYk2GMKcaPnOz
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sardaplywood.com - Port:
587 - Username:
superstars@sardaplywood.com - Password:
sup123st45 - Email To:
ch3rrysamuel@yandex.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1420-15-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exedescription pid process target process PID 736 set thread context of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exepid process 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 1420 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 1420 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe Token: SeDebugPrivilege 1420 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exepid process 1420 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exedescription pid process target process PID 736 wrote to memory of 1224 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe schtasks.exe PID 736 wrote to memory of 1224 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe schtasks.exe PID 736 wrote to memory of 1224 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe schtasks.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe PID 736 wrote to memory of 1420 736 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
outlook_office_path 1 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe -
outlook_win_path 1 IoCs
Processes:
05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mrBnPrWY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp18C3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\05332d194f758eae4b12ddda44c7dcda_JaffaCakes118.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp18C3.tmpFilesize
1KB
MD5f023fe16da0a6fa1fa051cdabb46efb6
SHA14ff6a03f2700dacc16085a7a2e3411e35ceda61f
SHA25670888c4c6f4bf891e1e1de92e15ae5a8142ea767680c739cb0b56e5925dcc724
SHA512485ff92a3ad281ee308f91debf5a90f14139f2b086e92d600661af0acc77d11f7e1809455882064f55cb5861c860415f134ecf518455941c8432f4044508acc3
-
memory/736-10-0x00000000084F0000-0x0000000008580000-memory.dmpFilesize
576KB
-
memory/736-3-0x00000000059A0000-0x0000000005A32000-memory.dmpFilesize
584KB
-
memory/736-1-0x0000000000F20000-0x0000000000FF0000-memory.dmpFilesize
832KB
-
memory/736-4-0x0000000005B60000-0x0000000005B70000-memory.dmpFilesize
64KB
-
memory/736-5-0x0000000005A60000-0x0000000005A6A000-memory.dmpFilesize
40KB
-
memory/736-6-0x0000000006CF0000-0x0000000006D8C000-memory.dmpFilesize
624KB
-
memory/736-7-0x0000000005CD0000-0x0000000005CE2000-memory.dmpFilesize
72KB
-
memory/736-8-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/736-11-0x000000000ACC0000-0x000000000AD42000-memory.dmpFilesize
520KB
-
memory/736-0-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/736-19-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/736-2-0x0000000006040000-0x00000000065E4000-memory.dmpFilesize
5.6MB
-
memory/736-9-0x0000000005B60000-0x0000000005B70000-memory.dmpFilesize
64KB
-
memory/1420-17-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/1420-25-0x00000000059D0000-0x00000000059E0000-memory.dmpFilesize
64KB
-
memory/1420-18-0x00000000059D0000-0x00000000059E0000-memory.dmpFilesize
64KB
-
memory/1420-20-0x0000000005960000-0x0000000005978000-memory.dmpFilesize
96KB
-
memory/1420-21-0x0000000005BF0000-0x0000000005C56000-memory.dmpFilesize
408KB
-
memory/1420-22-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/1420-23-0x00000000059D0000-0x00000000059E0000-memory.dmpFilesize
64KB
-
memory/1420-24-0x0000000006A40000-0x0000000006A90000-memory.dmpFilesize
320KB
-
memory/1420-15-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB