Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2024, 15:51

General

  • Target

    26108db5b69562376697d90215395c87_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    26108db5b69562376697d90215395c87

  • SHA1

    ebd57ecda0c2a6cca843ead90d9c845376dfe47a

  • SHA256

    406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

  • SHA512

    d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e

  • SSDEEP

    12288:mcf8x8hkm0WhdWCOt58IWDNuuc2eXNPnrEdrE:duj8IWDNuucxXN/odo

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 10 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 1616
        3⤵
        • Program crash
        PID:1524
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:2484
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
      2⤵
        PID:2572
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {E5815CB2-0ABA-4928-B3FF-629E0B5B1D87} S-1-5-21-1658372521-4246568289-2509113762-1000:PIRBKNPS\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
        C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:292
        • C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
          "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:572
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 1604
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:2540
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
            4⤵
            • Creates scheduled task(s)
            PID:1456
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
          3⤵
            PID:2740

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe

        Filesize

        2.2MB

        MD5

        26108db5b69562376697d90215395c87

        SHA1

        ebd57ecda0c2a6cca843ead90d9c845376dfe47a

        SHA256

        406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

        SHA512

        d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e

      • memory/292-48-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/292-27-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/292-25-0x0000000000E20000-0x0000000001058000-memory.dmp

        Filesize

        2.2MB

      • memory/572-50-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

        Filesize

        256KB

      • memory/572-49-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/572-42-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/572-38-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/572-40-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/572-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2780-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2780-4-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2780-18-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2780-21-0x0000000004DE0000-0x0000000004E20000-memory.dmp

        Filesize

        256KB

      • memory/2780-3-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2780-14-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2780-10-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2780-9-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2780-41-0x0000000004DE0000-0x0000000004E20000-memory.dmp

        Filesize

        256KB

      • memory/2780-17-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2780-34-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2780-6-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2780-5-0x00000000000C0000-0x00000000000E6000-memory.dmp

        Filesize

        152KB

      • memory/2856-0-0x0000000000200000-0x0000000000438000-memory.dmp

        Filesize

        2.2MB

      • memory/2856-26-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

        Filesize

        256KB

      • memory/2856-22-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2856-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

        Filesize

        256KB

      • memory/2856-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB