Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe
-
Size
386KB
-
MD5
013f51adbdfc57805523576f0864be2d
-
SHA1
2b1a2b04e027c5b238fe8aef247da0873ea7cc3e
-
SHA256
e57c9320ec6ae7d2fcb1bdc7d59033411b50fc5d4d28c88137d19fc1edaa279b
-
SHA512
579970a03258981a9ae879cd351ed8db06d4469dc726a82216886eb883087f7293afbeb2e54d3b2d7e185420517f55fd48740098a8e38291a6adc1f38cd1cbd0
-
SSDEEP
6144:TjbeifBxa5tFRRpYUcds1xuLhcmhqFecw51q99swY1JGfYIcg/9QmKX7:TuEAPFxZce1xuccq9w51q/sB1JfloOzr
Malware Config
Extracted
pony
http://gregorian.club/ifamandiebyaccident/gate.php
-
payload_url
http://myp0nysite.ru/shit.exe
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2824 z.cmd 2784 z.cmd -
Loads dropped DLL 3 IoCs
pid Process 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 2824 z.cmd -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts z.cmd -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook z.cmd -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2824 set thread context of 2784 2824 z.cmd 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2824 z.cmd 2824 z.cmd -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 2784 z.cmd Token: SeTcbPrivilege 2784 z.cmd Token: SeChangeNotifyPrivilege 2784 z.cmd Token: SeCreateTokenPrivilege 2784 z.cmd Token: SeBackupPrivilege 2784 z.cmd Token: SeRestorePrivilege 2784 z.cmd Token: SeIncreaseQuotaPrivilege 2784 z.cmd Token: SeAssignPrimaryTokenPrivilege 2784 z.cmd Token: SeImpersonatePrivilege 2784 z.cmd Token: SeTcbPrivilege 2784 z.cmd Token: SeChangeNotifyPrivilege 2784 z.cmd Token: SeCreateTokenPrivilege 2784 z.cmd Token: SeBackupPrivilege 2784 z.cmd Token: SeRestorePrivilege 2784 z.cmd Token: SeIncreaseQuotaPrivilege 2784 z.cmd Token: SeAssignPrimaryTokenPrivilege 2784 z.cmd Token: SeImpersonatePrivilege 2784 z.cmd Token: SeTcbPrivilege 2784 z.cmd Token: SeChangeNotifyPrivilege 2784 z.cmd Token: SeCreateTokenPrivilege 2784 z.cmd Token: SeBackupPrivilege 2784 z.cmd Token: SeRestorePrivilege 2784 z.cmd Token: SeIncreaseQuotaPrivilege 2784 z.cmd Token: SeAssignPrimaryTokenPrivilege 2784 z.cmd Token: SeImpersonatePrivilege 2784 z.cmd Token: SeTcbPrivilege 2784 z.cmd Token: SeChangeNotifyPrivilege 2784 z.cmd Token: SeCreateTokenPrivilege 2784 z.cmd Token: SeBackupPrivilege 2784 z.cmd Token: SeRestorePrivilege 2784 z.cmd Token: SeIncreaseQuotaPrivilege 2784 z.cmd Token: SeAssignPrimaryTokenPrivilege 2784 z.cmd -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2824 z.cmd 2824 z.cmd -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2824 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2824 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2824 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2824 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2824 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2824 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 28 PID 2288 wrote to memory of 2824 2288 013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe 28 PID 2824 wrote to memory of 2668 2824 z.cmd 29 PID 2824 wrote to memory of 2668 2824 z.cmd 29 PID 2824 wrote to memory of 2668 2824 z.cmd 29 PID 2824 wrote to memory of 2668 2824 z.cmd 29 PID 2824 wrote to memory of 2668 2824 z.cmd 29 PID 2824 wrote to memory of 2668 2824 z.cmd 29 PID 2824 wrote to memory of 2668 2824 z.cmd 29 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2824 wrote to memory of 2784 2824 z.cmd 31 PID 2784 wrote to memory of 2908 2784 z.cmd 33 PID 2784 wrote to memory of 2908 2784 z.cmd 33 PID 2784 wrote to memory of 2908 2784 z.cmd 33 PID 2784 wrote to memory of 2908 2784 z.cmd 33 PID 2784 wrote to memory of 2908 2784 z.cmd 33 PID 2784 wrote to memory of 2908 2784 z.cmd 33 PID 2784 wrote to memory of 2908 2784 z.cmd 33 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook z.cmd
Processes
-
C:\Users\Admin\AppData\Local\Temp\013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmdC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"3⤵
- Drops startup file
PID:2668
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmdC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:2784 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\259425341.bat" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd" "4⤵PID:2908
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
Filesize
134KB
MD56647faa08e188db28e4e53390ffc6d2b
SHA1d59f3f143dd58c02eb1b058ecdd6d4658fc34629
SHA256cf43adb1a0dbda08bebf3ab308a27a37367dd80c560b60ff06bf9d4352edb5f5
SHA5128e19290df23bd148bc55363903f725ecf2e048c0323e4b9419d661aab6add59b3cf6aff3f8d4ed1bc88cb1d396929b39cfb761925ef3f6fa3876a0174171c0e4
-
Filesize
556KB
MD583bc4854b7eafa9c4b600bfa1dabde33
SHA1da2cb1f8e307b42b576d868230f4bef64cb6e7af
SHA256f6c682000e1bdbde52416d3d6e716cca330d531c5374e32c426a13aebfb3252b
SHA51271407994762ca973d7d56b832b1972858f4b7680e78c3f6b745c68455b402b379042b5667b0e8758b5aa4a464572f47293c6fc425ed9ee7f5d80cb0adac7e005