Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 18:54

General

  • Target

    a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe

  • Size

    481KB

  • MD5

    a3ebdeb1cdb1799ec204e9f87ac051bf

  • SHA1

    8f51c5f8b4e4196bff4ebd07fb0416463ef2fd0d

  • SHA256

    49b8d86772f28a310f9d6924d91b1d3bc7ec7d30026eab48a628e057f751037c

  • SHA512

    80599a945d8fbffdc7094907401ef7407281930a0bde32c1e72124bfd5be87fd4fed96cab1b962752f0eac5ab4cab651cb7c1d1d441ef095340408cc94f28dcf

  • SSDEEP

    6144:D6Uqd2GhNuN728LAiPnvodg8X1ONbDcXYi3U1n4s2ajTuQOE9pGRYMK6s7lr:WUi2iNuo80ovoX1IbDW3UZ4j0OE7GaV

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3268
    • C:\Users\Admin\AppData\Local\Temp\a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3876
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3724

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe.log

            Filesize

            1KB

            MD5

            8ec831f3e3a3f77e4a7b9cd32b48384c

            SHA1

            d83f09fd87c5bd86e045873c231c14836e76a05c

            SHA256

            7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

            SHA512

            26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

          • memory/3268-10-0x00000000063F0000-0x0000000006450000-memory.dmp

            Filesize

            384KB

          • memory/3268-2-0x0000000005A10000-0x0000000005FB4000-memory.dmp

            Filesize

            5.6MB

          • memory/3268-3-0x00000000053A0000-0x0000000005432000-memory.dmp

            Filesize

            584KB

          • memory/3268-4-0x00000000055C0000-0x00000000055D0000-memory.dmp

            Filesize

            64KB

          • memory/3268-5-0x0000000005440000-0x000000000544A000-memory.dmp

            Filesize

            40KB

          • memory/3268-6-0x0000000005680000-0x000000000568E000-memory.dmp

            Filesize

            56KB

          • memory/3268-7-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/3268-8-0x00000000055C0000-0x00000000055D0000-memory.dmp

            Filesize

            64KB

          • memory/3268-0-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/3268-9-0x00000000061A0000-0x000000000623C000-memory.dmp

            Filesize

            624KB

          • memory/3268-16-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/3268-1-0x0000000000960000-0x00000000009DE000-memory.dmp

            Filesize

            504KB

          • memory/3876-11-0x0000000000400000-0x000000000043C000-memory.dmp

            Filesize

            240KB

          • memory/3876-15-0x0000000004E70000-0x0000000004E80000-memory.dmp

            Filesize

            64KB

          • memory/3876-14-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/3876-17-0x00000000050B0000-0x00000000050C8000-memory.dmp

            Filesize

            96KB

          • memory/3876-18-0x0000000005CF0000-0x0000000005D56000-memory.dmp

            Filesize

            408KB

          • memory/3876-19-0x0000000074520000-0x0000000074CD0000-memory.dmp

            Filesize

            7.7MB

          • memory/3876-20-0x0000000004E70000-0x0000000004E80000-memory.dmp

            Filesize

            64KB

          • memory/3876-21-0x0000000006060000-0x00000000060B0000-memory.dmp

            Filesize

            320KB