Analysis
-
max time kernel
142s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04-05-2024 17:13
Static task
static1
Behavioral task
behavioral1
Sample
13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe
-
Size
646KB
-
MD5
13b470ab4c1dde94867a567d88fdb673
-
SHA1
ffd3e2e7dc16bbe5d3e5b64ecae040a924cbcdc2
-
SHA256
519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb
-
SHA512
74ddc6aa93a5890762e856d2bb1b74cdf2acf1609edb27b3b790ad3efdbae00104ce5640ebc6b7edae07fe3267b5b4320a4c6bcb1400dc116a07f24b8242b568
-
SSDEEP
12288:u1PyErR7/1fRwhRkZAxk9jwhcyEGrHmvduHcyB8AjbZ+NdNbnFupx5I:sP9wv8Axk9mESHmvdu8SNPZAN
Malware Config
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/676-21-0x0000000000430000-0x00000000004B8000-memory.dmp MailPassView behavioral2/memory/1576-32-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/1576-33-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/1576-35-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/676-21-0x0000000000430000-0x00000000004B8000-memory.dmp WebBrowserPassView behavioral2/memory/764-36-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/764-37-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/764-44-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/676-21-0x0000000000430000-0x00000000004B8000-memory.dmp Nirsoft behavioral2/memory/1576-32-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1576-33-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1576-35-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/764-36-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/764-37-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/764-44-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" RegAsm.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 43 whatismyipaddress.com 45 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
installutil.exeRegAsm.exedescription pid process target process PID 2212 set thread context of 676 2212 installutil.exe RegAsm.exe PID 676 set thread context of 1576 676 RegAsm.exe vbc.exe PID 676 set thread context of 764 676 RegAsm.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
installutil.exevbc.exeRegAsm.exepid process 2212 installutil.exe 2212 installutil.exe 764 vbc.exe 764 vbc.exe 676 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
installutil.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2212 installutil.exe Token: SeDebugPrivilege 676 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 676 RegAsm.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exeinstallutil.exeRegAsm.exedescription pid process target process PID 4032 wrote to memory of 2212 4032 13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe installutil.exe PID 4032 wrote to memory of 2212 4032 13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe installutil.exe PID 4032 wrote to memory of 2212 4032 13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe installutil.exe PID 2212 wrote to memory of 1352 2212 installutil.exe schtasks.exe PID 2212 wrote to memory of 1352 2212 installutil.exe schtasks.exe PID 2212 wrote to memory of 1352 2212 installutil.exe schtasks.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 2212 wrote to memory of 676 2212 installutil.exe RegAsm.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 1576 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe PID 676 wrote to memory of 764 676 RegAsm.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\13b470ab4c1dde94867a567d88fdb673_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rGaqmF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB94D.tmp"3⤵
- Creates scheduled task(s)
PID:1352 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵
- Accesses Microsoft Outlook accounts
PID:1576 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Local\Temp\tmpB94D.tmpFilesize
1KB
MD57d0c7ca141c9ed88f0f0d963d32f35b1
SHA1f3e78fd690faa653b14e2750a0e4040a7aaa6936
SHA2561ea70f8ff6e7a0b68fa122c5e42caf7939c3d6e86cebd768ab7a39dd9895acfd
SHA5123ef6b2dd562ad370ed46c50dd9ac47440b4e70c666f378d54f26a70f267df50331e1778cd097c8507ad0e8b633d3ab22908dd7cb8e91f6fac903474a0f5a3576
-
memory/676-31-0x00000000075C0000-0x00000000075C8000-memory.dmpFilesize
32KB
-
memory/676-21-0x0000000000430000-0x00000000004B8000-memory.dmpFilesize
544KB
-
memory/676-24-0x0000000004A60000-0x0000000004A6A000-memory.dmpFilesize
40KB
-
memory/676-25-0x0000000004B80000-0x0000000004BD6000-memory.dmpFilesize
344KB
-
memory/676-28-0x0000000006C80000-0x0000000006CE6000-memory.dmpFilesize
408KB
-
memory/764-37-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/764-36-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/764-44-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1576-32-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1576-33-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1576-34-0x0000000000420000-0x00000000004E9000-memory.dmpFilesize
804KB
-
memory/1576-35-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2212-8-0x0000000004E00000-0x0000000004EA8000-memory.dmpFilesize
672KB
-
memory/2212-10-0x0000000072020000-0x00000000727D0000-memory.dmpFilesize
7.7MB
-
memory/2212-14-0x000000007202E000-0x000000007202F000-memory.dmpFilesize
4KB
-
memory/2212-23-0x0000000072020000-0x00000000727D0000-memory.dmpFilesize
7.7MB
-
memory/2212-13-0x00000000052F0000-0x0000000005380000-memory.dmpFilesize
576KB
-
memory/2212-12-0x0000000005070000-0x0000000005102000-memory.dmpFilesize
584KB
-
memory/2212-11-0x0000000005580000-0x0000000005B24000-memory.dmpFilesize
5.6MB
-
memory/2212-15-0x0000000072020000-0x00000000727D0000-memory.dmpFilesize
7.7MB
-
memory/2212-9-0x0000000004F30000-0x0000000004FCC000-memory.dmpFilesize
624KB
-
memory/2212-5-0x000000007202E000-0x000000007202F000-memory.dmpFilesize
4KB
-
memory/2212-7-0x0000000002720000-0x000000000273A000-memory.dmpFilesize
104KB
-
memory/2212-6-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4032-0-0x0000000075022000-0x0000000075023000-memory.dmpFilesize
4KB
-
memory/4032-4-0x0000000075020000-0x00000000755D1000-memory.dmpFilesize
5.7MB
-
memory/4032-2-0x0000000075020000-0x00000000755D1000-memory.dmpFilesize
5.7MB
-
memory/4032-1-0x0000000075020000-0x00000000755D1000-memory.dmpFilesize
5.7MB