Analysis

  • max time kernel
    143s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 07:45

General

  • Target

    28fbf26d76059fb5f277eaae5b7f894b_JaffaCakes118.exe

  • Size

    644KB

  • MD5

    28fbf26d76059fb5f277eaae5b7f894b

  • SHA1

    8bf8f4ccadd44da372359a31598856e187dc5b1f

  • SHA256

    97b1a0a2a2f05f22c3f9ac4152e34ad4d629c577ea9425020d5f8ce204d583d0

  • SHA512

    2db87c5f04edbfee71575ca045dd96e694e75b0c84a7400e01ba429af44987052d7b7b694bdbc5ef808b917d1f39d6ab6f521b40d895e3c1d8da938450800660

  • SSDEEP

    12288:q0wKEpZHDQi7vhMgWMzU9l9fDWmSsLbpnHrM8DoiQQWpH3UMQ9fp6zgJGE0:1Ejki75MTSCaaLbpnQ/zpU9ozMa

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 9 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 9 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 12 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:260
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:340
      • C:\Windows\system32\winlogon.exe
        winlogon.exe
        1⤵
          PID:436
        • C:\Windows\system32\lsm.exe
          C:\Windows\system32\lsm.exe
          1⤵
            PID:504
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch
            1⤵
              PID:604
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              1⤵
                PID:676
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                1⤵
                  PID:756
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs
                  1⤵
                    PID:868
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkService
                    1⤵
                      PID:348
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                      1⤵
                        PID:1044
                      • C:\Windows\system32\taskhost.exe
                        "taskhost.exe"
                        1⤵
                          PID:1124
                        • C:\Windows\system32\sppsvc.exe
                          C:\Windows\system32\sppsvc.exe
                          1⤵
                            PID:2040
                          • C:\Users\Admin\AppData\Local\Temp\28fbf26d76059fb5f277eaae5b7f894b_JaffaCakes118.exe
                            "C:\Users\Admin\AppData\Local\Temp\28fbf26d76059fb5f277eaae5b7f894b_JaffaCakes118.exe"
                            1⤵
                            • Suspicious use of SetThreadContext
                            • Modifies system certificate store
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2360
                            • C:\Users\Admin\AppData\Local\Temp\28fbf26d76059fb5f277eaae5b7f894b_JaffaCakes118.exe
                              "C:\Users\Admin\AppData\Local\Temp\28fbf26d76059fb5f277eaae5b7f894b_JaffaCakes118.exe"
                              2⤵
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:2544
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
                                3⤵
                                • Accesses Microsoft Outlook accounts
                                PID:1232
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
                                3⤵
                                  PID:2972

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                              Filesize

                              68KB

                              MD5

                              29f65ba8e88c063813cc50a4ea544e93

                              SHA1

                              05a7040d5c127e68c25d81cc51271ffb8bef3568

                              SHA256

                              1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                              SHA512

                              e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                              Filesize

                              1KB

                              MD5

                              a266bb7dcc38a562631361bbf61dd11b

                              SHA1

                              3b1efd3a66ea28b16697394703a72ca340a05bd5

                              SHA256

                              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                              SHA512

                              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                              Filesize

                              344B

                              MD5

                              7f86405c4f15aee9a53b8b35780338cf

                              SHA1

                              8a5b69d9636df0c4d8c986627ef8ed06a652f787

                              SHA256

                              f5c5d9066e08c7899da40a7893bbc5e062ade78a706c9f6f4afa115e3ba3b8db

                              SHA512

                              ac935fb1492bc21128861c67a501f1d36945635b44ae1806e8730f148b81b63e622455f7991c68773e8aa72c378f976abe3ee1a01b573d0e339669e2978f7515

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                              Filesize

                              344B

                              MD5

                              cbc224d22a6f8a21c08ed2b241b8825f

                              SHA1

                              ce81bc1e2d3aff7edc6bb5320efc9cca8e995002

                              SHA256

                              1544417f57befef2706bf311b49ec8218b3cd1fe9e041f3740465d9083e62b7c

                              SHA512

                              2a93ae29d46e565d17f20319747bc083170e643e0a7ef9f0c80cda1e2259ce41754b031feef182b5a34bacb61a76c9246a70f9631d596b748bd23fb8f1ff2863

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                              Filesize

                              242B

                              MD5

                              acc05a3a0c75a923f13808a45911bf36

                              SHA1

                              fa6b0efb1bc4c52f2691923ab833ee9974bb9777

                              SHA256

                              6afb0e9d3f67b936c6c6b2e24074de76d1c131e65a7adb23ceac94a429794a7f

                              SHA512

                              025ee98c2b8923f12b54e0c4692f41662c56c3019fca2d907733a2a0dc87c53cdc47926aef62287e2adeb90cdcc18dcfc8bee89d0033c4fa1690ec3e8a7eee26

                            • C:\Users\Admin\AppData\Local\Temp\432fggqdd.txt

                              Filesize

                              4B

                              MD5

                              f0f6ba4b5e0000340312d33c212c3ae8

                              SHA1

                              f40c22f2dc6461f1cd9243ad4df239052f78040f

                              SHA256

                              18177338c3669a1314d644b7f4ecfd18a5c735e819edf1e2062c3bc354d0dd7f

                              SHA512

                              b9537ba03e00791da5b07082b0a6ce3b087af1620f122c59f02edfc589d55794141496311841da65992cf9fc369d05d40a573d37b90da7f0228cc150c1c39988

                            • C:\Users\Admin\AppData\Local\Temp\4fggqdd.txt

                              Filesize

                              84B

                              MD5

                              ffde9988c78c77f01503787cb84611a3

                              SHA1

                              a945ba914b21ba99f3ddd8bfa13bdc2599ac7e6a

                              SHA256

                              9ab16cacc9cfc0ac83653c4a16beeb25ceaa63b01d6ad3f389e7aac917848a5c

                              SHA512

                              38536e7f0f74f4159176eefd053b44dddc7eef75cd6ff5d6563bc3a02bc5298c1c66719ceed94ed149fb7141ab68d8131accf13c0fd6f101d3e5b83bb90f32c6

                            • C:\Users\Admin\AppData\Local\Temp\Tar794.tmp

                              Filesize

                              177KB

                              MD5

                              435a9ac180383f9fa094131b173a2f7b

                              SHA1

                              76944ea657a9db94f9a4bef38f88c46ed4166983

                              SHA256

                              67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                              SHA512

                              1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                            • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

                              Filesize

                              2B

                              MD5

                              f3b25701fe362ec84616a93a45ce9998

                              SHA1

                              d62636d8caec13f04e28442a0a6fa1afeb024bbb

                              SHA256

                              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                              SHA512

                              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                            • C:\Users\Admin\AppData\Local\Temp\tmpA88.tmp

                              Filesize

                              66KB

                              MD5

                              aaa698721f488b181bc0f0afc5da126a

                              SHA1

                              76536a73f16ffd643ea24f8725cebfff9d49852f

                              SHA256

                              e71ba7ce01d10e60a4feac7fc5e04f34756ba621c7d88583d0f96bd3b2655647

                              SHA512

                              67d8b05678fbdc1678515c341fa8c1e26f3d1b15f2cc390bb9b1a26589a346fd57697dd3366e72d46ab265570929f1be89b8aec81112a2a98194c5886c89261d

                            • memory/260-166-0x0000000000110000-0x0000000000111000-memory.dmp

                              Filesize

                              4KB

                            • memory/1232-263-0x0000000000400000-0x000000000041B000-memory.dmp

                              Filesize

                              108KB

                            • memory/1232-260-0x0000000000400000-0x000000000041B000-memory.dmp

                              Filesize

                              108KB

                            • memory/1232-259-0x0000000000400000-0x000000000041B000-memory.dmp

                              Filesize

                              108KB

                            • memory/2360-215-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2360-1-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2360-0-0x0000000074951000-0x0000000074952000-memory.dmp

                              Filesize

                              4KB

                            • memory/2544-154-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-152-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                              Filesize

                              4KB

                            • memory/2544-161-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-213-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2544-147-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-214-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2544-216-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2544-217-0x0000000073E90000-0x0000000073EBE000-memory.dmp

                              Filesize

                              184KB

                            • memory/2544-220-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2544-146-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-149-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-151-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-261-0x0000000073E90000-0x0000000073EBE000-memory.dmp

                              Filesize

                              184KB

                            • memory/2544-164-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-321-0x0000000073E90000-0x0000000073EBE000-memory.dmp

                              Filesize

                              184KB

                            • memory/2544-320-0x0000000073E90000-0x0000000073EBE000-memory.dmp

                              Filesize

                              184KB

                            • memory/2544-155-0x0000000000080000-0x0000000000104000-memory.dmp

                              Filesize

                              528KB

                            • memory/2544-314-0x0000000073E90000-0x0000000073EBE000-memory.dmp

                              Filesize

                              184KB

                            • memory/2544-270-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2544-272-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2544-309-0x0000000074950000-0x0000000074EFB000-memory.dmp

                              Filesize

                              5.7MB

                            • memory/2544-310-0x0000000073E90000-0x0000000073EBE000-memory.dmp

                              Filesize

                              184KB

                            • memory/2544-312-0x0000000073E90000-0x0000000073EBE000-memory.dmp

                              Filesize

                              184KB

                            • memory/2972-269-0x0000000000400000-0x0000000000458000-memory.dmp

                              Filesize

                              352KB

                            • memory/2972-265-0x0000000000400000-0x0000000000458000-memory.dmp

                              Filesize

                              352KB

                            • memory/2972-264-0x0000000000400000-0x0000000000458000-memory.dmp

                              Filesize

                              352KB