Analysis
-
max time kernel
149s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 20:49
Static task
static1
Behavioral task
behavioral1
Sample
2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
2ba3cd628ff02e6db45ae46778560953
-
SHA1
243a4d48ab4b6791c8bff0d58d878826f7dd9bec
-
SHA256
225d469955bed2ee317957e80a774ee37d51dd48fff41c5e8b75eb386bc9a666
-
SHA512
058c29447f73cab7115e0ce81bf43ac4bb3dd0fccd7da176ba03441770b25d4ff35239d3c0a67812d05c99d13c4b6d6e502233fedf6789a8f58ddd0099a3ccd9
-
SSDEEP
12288:q3mGI2uttEwDfl1o34BWQXyyTN0ebL9jObeIumkgVs4fyLh0jrBF1vpjlfBGHV4s:jX1rUm1bhaf9lqpIcN1H5
Malware Config
Signatures
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3476-82-0x0000000000BE0000-0x0000000000C70000-memory.dmp m00nd3v_logger -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/4352-91-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/4352-98-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 2 IoCs
resource yara_rule behavioral2/memory/4352-91-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4352-98-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startupname.Lnk cscript.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3476 set thread context of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 1164 set thread context of 4352 1164 RegAsm.exe 104 PID 1164 set thread context of 4512 1164 RegAsm.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3476 wrote to memory of 5316 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 85 PID 3476 wrote to memory of 5316 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 85 PID 3476 wrote to memory of 5316 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 85 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 3476 wrote to memory of 1164 3476 2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe 103 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4352 1164 RegAsm.exe 104 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105 PID 1164 wrote to memory of 4512 1164 RegAsm.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ba3cd628ff02e6db45ae46778560953_JaffaCakes118.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\System32\cscript.exe" //B //Nologo C:\Users\Admin\startupname.vbs2⤵
- Drops startup file
PID:5316
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpED49.tmp"3⤵PID:4352
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpF151.tmp"3⤵
- Accesses Microsoft Outlook accounts
PID:4512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5a35b8711bea28d54fb7a350adceb3f76
SHA15872d7a95a74ec6de08194283027fcf2cdb96390
SHA256a90449e696cb37fa289ab8dcd0888734c74d0b61273231a0ce0e93adfd2d8137
SHA512d997e0ace25eff648f16395a4771402465b39fa059d3b0f36efbd743c691bf4308c58d5585e3aebc63c206d18d01edf46f14b0cb5cffe6f1d5bf9132d76d9210
-
Filesize
2.0MB
MD52ba3cd628ff02e6db45ae46778560953
SHA1243a4d48ab4b6791c8bff0d58d878826f7dd9bec
SHA256225d469955bed2ee317957e80a774ee37d51dd48fff41c5e8b75eb386bc9a666
SHA512058c29447f73cab7115e0ce81bf43ac4bb3dd0fccd7da176ba03441770b25d4ff35239d3c0a67812d05c99d13c4b6d6e502233fedf6789a8f58ddd0099a3ccd9
-
Filesize
311B
MD5c31ad124a35a88ebb3fa40c91a9b7b2f
SHA122a4b4632a8e614f4b0f8b3d2976952e98b84869
SHA256478b3c404ecf2bceb32f92a698b4072be954c0f4f98886ec58d9462ec0371eec
SHA5127eef8c6d1999c44714ee6a20de57b4b3154195fc7f55b2264dce637303ed51924f09420f28c9a343e9772cd06f4de5cffe2f3fc15411cff6d63b2754ba44c7b6