Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 13:46
Static task
static1
Behavioral task
behavioral1
Sample
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe
-
Size
866KB
-
MD5
23973cb9baa01a886c7551d666ba7006
-
SHA1
097f07fd6db247bcac29ef8f5e8566e7f19d2227
-
SHA256
a7ae2c69ff2d3d5ebb15f69f9151bb99ee3ed333fdd42eb75b7044161bf8818e
-
SHA512
8ad5424fc34e15d27b688de10029e31faa4c70a109c4daebba45dba74d0723f294b39004b5ae0f782c475c6e5b7bd0c42aafac7112b6c46e90b866419e749a59
-
SSDEEP
24576:NgTiy5KGy4xaxvSVXr4L4852MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMX:Ng+gaIr46MMMMMMMMMMMuMMMMMMMMMMw
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.indiacarpet.in - Port:
587 - Username:
[email protected] - Password:
india@12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2632-9-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exedescription pid process target process PID 2572 set thread context of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exepid process 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exedw20.exedescription pid process Token: SeDebugPrivilege 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe Token: SeRestorePrivilege 4172 dw20.exe Token: SeBackupPrivilege 4172 dw20.exe Token: SeBackupPrivilege 4172 dw20.exe Token: SeBackupPrivilege 4172 dw20.exe Token: SeBackupPrivilege 4172 dw20.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 2572 wrote to memory of 960 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe schtasks.exe PID 2572 wrote to memory of 960 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe schtasks.exe PID 2572 wrote to memory of 960 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe schtasks.exe PID 2572 wrote to memory of 1200 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 1200 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 1200 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2572 wrote to memory of 2632 2572 23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe RegSvcs.exe PID 2632 wrote to memory of 4172 2632 RegSvcs.exe dw20.exe PID 2632 wrote to memory of 4172 2632 RegSvcs.exe dw20.exe PID 2632 wrote to memory of 4172 2632 RegSvcs.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\23973cb9baa01a886c7551d666ba7006_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QHYIdGLuzUUb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFD3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7723⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCFD3.tmpFilesize
1KB
MD57f7f67f829ce043d6f8e08b5e3bd1a46
SHA165973fb0f3bd85d8f8859b808650aff3e66c80e8
SHA256549924c78b5bb75670209b2f4d25d22965c717196681937bd0d408794afce776
SHA5124b84077736290f0cb5421b6c9b45b9646ddc7f8e43c064ae30fbed5a800bf82ec0bfc61f5dfdcceef6f766ca416457734fd1f762e343fd6693b2e6f4feec5cf0
-
memory/2572-0-0x0000000075110000-0x00000000756C1000-memory.dmpFilesize
5.7MB
-
memory/2572-1-0x0000000075110000-0x00000000756C1000-memory.dmpFilesize
5.7MB
-
memory/2572-2-0x0000000000D90000-0x0000000000DA0000-memory.dmpFilesize
64KB
-
memory/2572-3-0x0000000075110000-0x00000000756C1000-memory.dmpFilesize
5.7MB
-
memory/2572-4-0x0000000000D90000-0x0000000000DA0000-memory.dmpFilesize
64KB
-
memory/2572-5-0x0000000000D90000-0x0000000000DA0000-memory.dmpFilesize
64KB
-
memory/2572-11-0x0000000075110000-0x00000000756C1000-memory.dmpFilesize
5.7MB
-
memory/2632-9-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2632-12-0x0000000075110000-0x00000000756C1000-memory.dmpFilesize
5.7MB
-
memory/2632-13-0x0000000001130000-0x0000000001140000-memory.dmpFilesize
64KB
-
memory/2632-20-0x0000000075110000-0x00000000756C1000-memory.dmpFilesize
5.7MB