Malware Analysis Report

2024-11-30 23:43

Sample ID 240429-nqagwahh7x
Target 0792989f119bbd40d5007b97dcd1686e_JaffaCakes118
SHA256 f41b9c371e86408b1247d6465b36ba7134ca8c081580ad5fb0e913d215263ad3
Tags
lokibot collection spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f41b9c371e86408b1247d6465b36ba7134ca8c081580ad5fb0e913d215263ad3

Threat Level: Known bad

The file 0792989f119bbd40d5007b97dcd1686e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

lokibot collection spyware stealer trojan

Lokibot

Reads user/profile data of web browsers

Enumerates connected drives

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Checks computer location settings

Drops file in Windows directory

Executes dropped EXE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

outlook_office_path

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_win_path

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Creates scheduled task(s)

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-29 11:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-29 11:35

Reported

2024-04-29 11:38

Platform

win7-20240221-en

Max time kernel

138s

Max time network

117s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0792989f119bbd40d5007b97dcd1686e_JaffaCakes118.msi

Signatures

Lokibot

trojan spyware stealer lokibot

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 872 set thread context of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 set thread context of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI32B4.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI3304.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\Installer\f76317c.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f76317f.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\Installer\f76317c.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f76317f.ipi C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI3304.tmp N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Installer\MSI3304.tmp N/A
N/A N/A C:\Windows\Installer\MSI3304.tmp N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI3304.tmp N/A
N/A N/A C:\Windows\Installer\MSI3304.tmp N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI3304.tmp N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 2540 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI3304.tmp
PID 3040 wrote to memory of 2540 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI3304.tmp
PID 3040 wrote to memory of 2540 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI3304.tmp
PID 3040 wrote to memory of 2540 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI3304.tmp
PID 2540 wrote to memory of 1456 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 2540 wrote to memory of 1456 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 2540 wrote to memory of 1456 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 2540 wrote to memory of 1456 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 2540 wrote to memory of 2248 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 2540 wrote to memory of 2248 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 2540 wrote to memory of 2248 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 2540 wrote to memory of 2248 N/A C:\Windows\Installer\MSI3304.tmp C:\Windows\SysWOW64\schtasks.exe
PID 900 wrote to memory of 872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 900 wrote to memory of 872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 900 wrote to memory of 872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 900 wrote to memory of 872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 872 wrote to memory of 1696 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 900 wrote to memory of 2736 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 900 wrote to memory of 2736 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 900 wrote to memory of 2736 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 900 wrote to memory of 2736 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 2736 wrote to memory of 2344 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0792989f119bbd40d5007b97dcd1686e_JaffaCakes118.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000578" "00000000000004C0"

C:\Windows\Installer\MSI3304.tmp

"C:\Windows\Installer\MSI3304.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Notesbger" /TR "\"C:\ProgramData\Anhang1.exe\""

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /run /tn "Notesbger"

C:\Windows\system32\taskeng.exe

taskeng.exe {34341F0B-44CD-4BD6-BC84-7881670320F2} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 angelbiss.space udp

Files

C:\Windows\Installer\MSI3304.tmp

MD5 0b9991bac57a03beb7848051d88bbd86
SHA1 0cf8a4c5c1f804cfb9fcf83a2fa54154b4d4a10e
SHA256 fc32567cd8fe30343ded8d74b160eb3ce7ca085567456d6923e6e5678a3f605b
SHA512 d65f59e701693d6121a467c957178ff88d738ce0579e664b8a1b68c0f580e133fdeb30a5613ebbfa2c93a639f4430be035537edb0037d104fb58277de6bc123a

C:\Config.Msi\f763180.rbs

MD5 07774a77216325199865f8a704ce0edb
SHA1 3b01ae3e041ef0bed7c41b33bee5d0e616a07cef
SHA256 5e17d799ef7771f11aac7904fcef52c7344944887ce9b3c4db0f958d9c5bdc03
SHA512 b58684817a17ed25ef5cbe4632bafd7978434ac43d87c243eb1d176101da12e07f94efb3ae0c274938e84c886ee696abdc5d8888e7b82ddbec01c0efa53e9074

C:\ProgramData\Anhang1.exe

MD5 5b13d7cafae2a6f70999ed7072da8383
SHA1 afaf8b027d978a92fc98e1ed290c1b77ac60ef2c
SHA256 d802a2930a4e81322e741521b69771c46ba491305db6bc3439829cc008296034
SHA512 2782c5e4450fcf8136082af33a20f404609e66e710af5a4ec0247b0257325bd7f03c09ca11307737ae611b602db77134f56890fb0cc3e9e84dfa00b395f4607d

memory/1696-31-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1696-33-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3452737119-3959686427-228443150-1000\0f5007522459c86e95ffcc62f32308f1_ad04ce47-83ca-4cca-a79e-77cdc80ce41e

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3452737119-3959686427-228443150-1000\0f5007522459c86e95ffcc62f32308f1_ad04ce47-83ca-4cca-a79e-77cdc80ce41e

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/2344-57-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1696-65-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1696-84-0x0000000000400000-0x00000000004A2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-29 11:35

Reported

2024-04-29 11:38

Platform

win10v2004-20240419-en

Max time kernel

147s

Max time network

148s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0792989f119bbd40d5007b97dcd1686e_JaffaCakes118.msi

Signatures

Lokibot

trojan spyware stealer lokibot

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation C:\Windows\Installer\MSI6A92.tmp N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 700 set thread context of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\e576987.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e576987.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6A33.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI6A92.tmp C:\Windows\system32\msiexec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI6A92.tmp N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000066def5a81497f7c40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000066def5a80000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090066def5a8000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d66def5a8000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066def5a800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Installer\MSI6A92.tmp N/A
N/A N/A C:\Windows\Installer\MSI6A92.tmp N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI6A92.tmp N/A
N/A N/A C:\Windows\Installer\MSI6A92.tmp N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Installer\MSI6A92.tmp N/A
N/A N/A C:\ProgramData\Anhang1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4884 wrote to memory of 2984 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 4884 wrote to memory of 2984 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 4884 wrote to memory of 976 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6A92.tmp
PID 4884 wrote to memory of 976 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6A92.tmp
PID 4884 wrote to memory of 976 N/A C:\Windows\system32\msiexec.exe C:\Windows\Installer\MSI6A92.tmp
PID 976 wrote to memory of 4432 N/A C:\Windows\Installer\MSI6A92.tmp C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 4432 N/A C:\Windows\Installer\MSI6A92.tmp C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 4432 N/A C:\Windows\Installer\MSI6A92.tmp C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 4556 N/A C:\Windows\Installer\MSI6A92.tmp C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 4556 N/A C:\Windows\Installer\MSI6A92.tmp C:\Windows\SysWOW64\schtasks.exe
PID 976 wrote to memory of 4556 N/A C:\Windows\Installer\MSI6A92.tmp C:\Windows\SysWOW64\schtasks.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe
PID 700 wrote to memory of 1548 N/A C:\ProgramData\Anhang1.exe C:\ProgramData\Anhang1.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\ProgramData\Anhang1.exe N/A

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0792989f119bbd40d5007b97dcd1686e_JaffaCakes118.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\Installer\MSI6A92.tmp

"C:\Windows\Installer\MSI6A92.tmp"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN "Notesbger" /TR "\"C:\ProgramData\Anhang1.exe\""

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /run /tn "Notesbger"

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

C:\ProgramData\Anhang1.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 239.249.30.184.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 angelbiss.space udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 137.191.110.104.in-addr.arpa udp
US 8.8.8.8:53 angelbiss.space udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 angelbiss.space udp

Files

C:\Windows\Installer\MSI6A92.tmp

MD5 0b9991bac57a03beb7848051d88bbd86
SHA1 0cf8a4c5c1f804cfb9fcf83a2fa54154b4d4a10e
SHA256 fc32567cd8fe30343ded8d74b160eb3ce7ca085567456d6923e6e5678a3f605b
SHA512 d65f59e701693d6121a467c957178ff88d738ce0579e664b8a1b68c0f580e133fdeb30a5613ebbfa2c93a639f4430be035537edb0037d104fb58277de6bc123a

\??\Volume{a8f5de66-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6056ef9c-73d1-4327-94b1-e813c28792a1}_OnDiskSnapshotProp

MD5 9242cdf746aaabf9d5d2efa337d3f173
SHA1 0650085e952bc1bcaef7f8e4162e9d91b9d86c82
SHA256 c5165205804834eb6691796b5af580062f8ece401d67c832e395e6173da068ad
SHA512 c75aaca287099c7df57e7c74d963abf262f5e1515e272bf2397db5ac9ab17a5d8c41b1492443d242f1ea69531e514307893e0254372ef506ae616d56754435e2

\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

MD5 02be3018f7fa23a54b60b407f2233925
SHA1 cd7f9950ab42876a4c6266702858372fcd2acc30
SHA256 ba44a0b962d09c361c5b44f53d6ca1b7cd161442b6cf83f8b2f3688f773eb8e6
SHA512 4883f85bdeb7e47ae038018e5268884736b91f48efc022018d03b3d65f68ea3114ba21f3f37b78983db9423241c7e8b22d7c94c06835a958bff4e5a9fc6b7fdf

C:\Config.Msi\e57698a.rbs

MD5 5fec0cc98cc56dc77c5096737941477d
SHA1 365817f3e8bffa4517684fe5e98e373c5d29bf65
SHA256 dcfc882794f18f048f8c61da5873007b5ddb56e1de619369ec2b6d2269c3e17b
SHA512 bcac9c8f10c399499a04c883cba39bc5a35c216157397f38ce7ef0098343fce3ff58f00300f5d44b201c3caf5a28cf78af5e63a304c551280c7babacbe989b16

C:\ProgramData\Anhang1.exe

MD5 5b13d7cafae2a6f70999ed7072da8383
SHA1 afaf8b027d978a92fc98e1ed290c1b77ac60ef2c
SHA256 d802a2930a4e81322e741521b69771c46ba491305db6bc3439829cc008296034
SHA512 2782c5e4450fcf8136082af33a20f404609e66e710af5a4ec0247b0257325bd7f03c09ca11307737ae611b602db77134f56890fb0cc3e9e84dfa00b395f4607d

memory/1548-31-0x0000000000400000-0x00000000004A2000-memory.dmp

memory/1548-33-0x0000000000400000-0x00000000004A2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2818691465-3043947619-2475182763-1000\0f5007522459c86e95ffcc62f32308f1_f546c72a-ef7d-4387-9afa-727536aab388

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2818691465-3043947619-2475182763-1000\0f5007522459c86e95ffcc62f32308f1_f546c72a-ef7d-4387-9afa-727536aab388

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

memory/1548-75-0x0000000000400000-0x00000000004A2000-memory.dmp