Analysis
-
max time kernel
134s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 04:39
Static task
static1
Behavioral task
behavioral1
Sample
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe
-
Size
992KB
-
MD5
f986d81f9a28faf01d2426d86e349bac
-
SHA1
6040d35992bc2a832947bc5f0344a634ede94e89
-
SHA256
5bd92e772084c04101f784250361ab3c9caf589c718bb13aa9e5e2a75621936b
-
SHA512
259053716e8b5e67da30ee5bfe823ad591b7418f93cf4e1eacbdfab05cc238846014f744c3c763f2c60d2bd105891dd2670eaed4a95dab355d1e95ec0fb5873b
-
SSDEEP
12288:Qz9/32XvY6CD6zzXGytE0/OJKG+UlIKfJuUKo1nWjhStiSbUccDJIwsromI:U9vesuzzXGyO0/OJKiICuUKtYcwUccH/
Malware Config
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2500-32-0x0000000000400000-0x0000000000419000-memory.dmp MailPassView behavioral2/memory/2500-34-0x0000000000400000-0x0000000000419000-memory.dmp MailPassView behavioral2/memory/2500-35-0x0000000000400000-0x0000000000419000-memory.dmp MailPassView -
Nirsoft 12 IoCs
Processes:
resource yara_rule behavioral2/memory/3804-18-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/3804-20-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/3804-21-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/2500-32-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral2/memory/2500-34-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral2/memory/2500-35-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral2/memory/4816-46-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/4816-48-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/4816-49-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral2/memory/3376-60-0x0000000000400000-0x0000000000412000-memory.dmp Nirsoft behavioral2/memory/3376-62-0x0000000000400000-0x0000000000412000-memory.dmp Nirsoft behavioral2/memory/3376-63-0x0000000000400000-0x0000000000412000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/5116-65-0x0000000010000000-0x000000001001F000-memory.dmp upx behavioral2/memory/5116-68-0x0000000010000000-0x000000001001F000-memory.dmp upx behavioral2/memory/5116-67-0x0000000010000000-0x000000001001F000-memory.dmp upx behavioral2/memory/5116-79-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exedescription pid process target process PID 5116 set thread context of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 set thread context of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 set thread context of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 set thread context of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exef986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exepid process 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe 3804 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe 3804 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exef986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3804 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe Token: SeDebugPrivilege 3376 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exedescription pid process target process PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3804 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 2500 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 4816 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe PID 5116 wrote to memory of 3376 5116 f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
-
C:\Users\Admin\AppData\Local\Temp\f986d81f9a28faf01d2426d86e349bac_JaffaCakes118.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2500-31-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2500-35-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2500-34-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2500-32-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2500-29-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2500-30-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3376-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3376-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3376-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3376-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3376-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3376-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3804-20-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3804-17-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3804-14-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3804-18-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3804-16-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3804-21-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4816-44-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4816-46-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4816-48-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4816-49-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4816-45-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4816-43-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/5116-2-0x0000000000AC0000-0x0000000000AE7000-memory.dmpFilesize
156KB
-
memory/5116-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5116-8-0x00000000006D0000-0x00000000006DA000-memory.dmpFilesize
40KB
-
memory/5116-3-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/5116-65-0x0000000010000000-0x000000001001F000-memory.dmpFilesize
124KB
-
memory/5116-68-0x0000000010000000-0x000000001001F000-memory.dmpFilesize
124KB
-
memory/5116-67-0x0000000010000000-0x000000001001F000-memory.dmpFilesize
124KB
-
memory/5116-79-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB