Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30/03/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe
-
Size
308KB
-
MD5
3d6ae742ec7b2d75583674e68eb36c83
-
SHA1
bbac972b8bf06457d066fe076fc44d0feb3d25e7
-
SHA256
6065a675d7139a622ce9b68fbd2b6909ce47acc09a24afcf697b170b8ed53b3b
-
SHA512
a3e8e6da96acb9b3b5e7d5187b8343dc43b1f095fec330d4dbdcd02b309df28a771871962ae130bdaf6293baed6d9a2d552f00b5ec6a747255b3a35027a010fb
-
SSDEEP
6144:D+Vi9RVh7Z+z2qONZYP5zeYs9MrIYlK5:DldFZ+z2qONZYP5Rs9MrI
Malware Config
Extracted
lokibot
http://checkvim.com/fd4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook 3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3464 3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3464 3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook 3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d6ae742ec7b2d75583674e68eb36c83_JaffaCakes118.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-609813121-2907144057-1731107329-1000\0f5007522459c86e95ffcc62f32308f1_0eba5ade-06df-4bb4-82bc-b49b963c83eb
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61