Overview

overview

10

Static

static

1

188debc6e6...18.msi

windows7-x64

10

188debc6e6...18.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 16:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    188debc6e602735db40b63dc7842be48_JaffaCakes118.msi

  • Size

    1.2MB

  • MD5

    188debc6e602735db40b63dc7842be48

  • SHA1

    41b2f74e2d4bda6378da829c8f486338d439c2ed

  • SHA256

    2619a7f6787412012ec4d3eb0bf909aa9b34d2c0a94d35af5a2b05baa21ea5ae

  • SHA512

    22625eef4d106b1dd3b1c2d45f072710fdf805c07cd122f222c5e9d10618df40a7324655620c676995629224158308895edb8699a06bad66a5c429cd6a10791f

  • SSDEEP

    12288:mEc4Zs866fwoPuMwBmfBPYqqHPWiLWOfVHtbIw6AOvTwuyH3kV3YzGJ:mEcy0sHWmpPQWiLWOX2TD3YzG

Score
10/10
m00nd3v_loggerinfostealerspywarestealer

Malware Config

Signatures

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nD3v Logger payload 1 IoCs

    Detects M00nD3v Logger payload in memory.

    infostealer
  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\188debc6e602735db40b63dc7842be48_JaffaCakes118.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4796
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3196
    • C:\Windows\Installer\MSI758F.tmp
      "C:\Windows\Installer\MSI758F.tmp"
      2⤵
      • Drops desktop.ini file(s)
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe"
        3⤵
        • NTFS ADS
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
          4⤵
            PID:2740
        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
          3⤵
          • Executes dropped EXE
          PID:1796
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3248

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e577497.rbs
      Filesize

      663B

      MD5

      da2eed6f039b6bff36a5a819e5a0b404

      SHA1

      b074a3d25b7eff18a63bc2cddc6d61a5ba4e99b3

      SHA256

      3065db72592c2f7deb04b2a69e34ba72bc97d061618908e115b126197c39b44d

      SHA512

      659edf02f311c611e36934dc16e24437921fd85afa25d83755527613c42cf29da32da1e028326347ef29cdd332dd5332e76d5b312dc929d19080e8f327ab31af

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      Filesize

      89KB

      MD5

      84c42d0f2c1ae761bef884638bc1eacd

      SHA1

      4353881e7f4e9c7610f4e0489183b55bb58bb574

      SHA256

      331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3

      SHA512

      43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

      Download Submit

    • C:\Windows\Installer\MSI758F.tmp
      Filesize

      1.2MB

      MD5

      6e12fc33856e334c82dd65c6e1188732

      SHA1

      e1b00cc9343b2970c6521c708c7cbdfddd6d2a10

      SHA256

      16fae5775fcaafa5a98eb3bfacd7e8e90709a07f0c77fed992ec3937f4ecc3fb

      SHA512

      99219b8c3cd730c90b56d3272400edc656d2f1ea7d46fabc4b37906e722c63feda3aa75e19b09432b68c49fb179200a537651dae552e63d55b407ea5718222e7

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      24.1MB

      MD5

      717e4169fb916c565f8717460558ab89

      SHA1

      b50a03c608c3302560798f629e8e7ab3c2f76b47

      SHA256

      0a193554f64d53fa0f4a1b64b821db8ede9365f0d904d662e0162f445f390366

      SHA512

      7377f7111c86a3cbaaa65606165ecd12e73b06a903e8afbb0149191004c2322e20c50dbe57e33359288e2a62d95bb7d0c1264fac0c047cf2cfd7361a83ba644d

      Download Submit

    • \??\Volume{a8f5de66-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6a7aa5d6-bad3-4986-8930-2e883009a053}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      b755bcda0b742a853a9d2f8fe745078f

      SHA1

      0142c7f8e610d1c252f8d49d433fa879e738ff9f

      SHA256

      654c181da59a3d8e4ac2dc93109b5e08a5608e288f9a91303263d0ccd8833010

      SHA512

      88f0643fdfa03e3d6cdbcee54d8cb162de95709978752e5a531e99a1beee3238e30125cd39636e0528b7d33b4af17ab3999b473a2de057a307d74b8012671963

      Download Submit

    • memory/1796-23-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download