Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
Resource
win10v2004-20240426-en
General
-
Target
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
-
Size
493KB
-
MD5
33ca486ee889bc38d992e033ea20cb5a
-
SHA1
c26e975dbc222bfdd9a7fd628c9a76d5fb9ed2ec
-
SHA256
d01d56d0488f4286f99b67ea683b80cb85cb1a1740aa92470c3b2466f0ea207a
-
SHA512
7f9055d413103fb0d33383c915fe39d5880fb3c2bc77d2de232388d89cc0d45d865c446a6cee06472863d0b0b70fa431ca217e0a36e1191160864d12c3c8adb2
-
SSDEEP
12288:zZUvZhblII/vlJEzfYT7a19RKXHMyv+A9:zINlIAJM+7mzKbmM
Malware Config
Extracted
lokibot
https://afrisoccer.co.tz/cgi/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sleb.exepid process 2660 sleb.exe -
Loads dropped DLL 2 IoCs
Processes:
sleb.exepid process 2660 sleb.exe 2660 sleb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cmd.exe Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook cmd.exe Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
sleb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WIRE1x (2.5.1) = "\\WIRE1x_2_5_1.exe" sleb.exe -
Drops file in Windows directory 1 IoCs
Processes:
sleb.exedescription ioc process File opened for modification C:\Windows\win.ini sleb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exesleb.exepid process 2876 powershell.exe 2660 sleb.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sleb.exepid process 2660 sleb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.execmd.exedescription pid process Token: SeDebugPrivilege 2876 powershell.exe Token: SeDebugPrivilege 4716 cmd.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
powershell.exesleb.exeDllHost.execmd.exedescription pid process target process PID 2876 wrote to memory of 2660 2876 powershell.exe sleb.exe PID 2876 wrote to memory of 2660 2876 powershell.exe sleb.exe PID 2876 wrote to memory of 2660 2876 powershell.exe sleb.exe PID 2876 wrote to memory of 2660 2876 powershell.exe sleb.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 2660 wrote to memory of 4716 2660 sleb.exe cmd.exe PID 4608 wrote to memory of 4576 4608 DllHost.exe cmd.exe PID 4608 wrote to memory of 4576 4608 DllHost.exe cmd.exe PID 4608 wrote to memory of 4576 4608 DllHost.exe cmd.exe PID 4608 wrote to memory of 4576 4608 DllHost.exe cmd.exe PID 4576 wrote to memory of 4548 4576 cmd.exe reg.exe PID 4576 wrote to memory of 4548 4576 cmd.exe reg.exe PID 4576 wrote to memory of 4548 4576 cmd.exe reg.exe PID 4576 wrote to memory of 4548 4576 cmd.exe reg.exe -
outlook_office_path 1 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmd.exe -
outlook_win_path 1 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cmd.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\sleb.exe"C:\Users\Public\sleb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer" /t REG_DWORD /d 0"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer" /t REG_DWORD /d 03⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3452737119-3959686427-228443150-1000\0f5007522459c86e95ffcc62f32308f1_ad04ce47-83ca-4cca-a79e-77cdc80ce41eFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3452737119-3959686427-228443150-1000\0f5007522459c86e95ffcc62f32308f1_ad04ce47-83ca-4cca-a79e-77cdc80ce41eFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Public\sleb.exeFilesize
351KB
MD5748f776174ae1f276549d965f8197ea8
SHA13bb89c7f06784ab2a2a5fdd3e608c3758fddbd57
SHA25692ea1e6f6231537e78636e4a094aeb6b90dea2ca5ea62135b5900fdc080809ac
SHA5123ac408ffb957d8f9392e51faf4d6f2af258ca428ff93d61bcda6cb4a1932929bec285cda9d73d666b6bd1c25be0ca0084ee57f601807b0ce3be225235d4c5e37
-
C:\Windows\win.iniFilesize
517B
MD5893cae59ab5945a94a7da007d47a1255
SHA1d4cfd81c6647ca64022bd307c08a7fb4bbbd4c06
SHA256edfa0f2d3bea9f737e0315971c6f81d3d8e7d460b60a19351ada0316a093c938
SHA512d66e454781f54f45df814ad32d687b0f100578c2a4ffca62de81add04281fb881a550702bd2d058933d3736d14e88624af268a86ce24b0c3935242b206ffdcc9
-
\Users\Admin\AppData\Local\Temp\bagnios.dllFilesize
136KB
MD5ed9eb10ec841fd7ba6bf475fa6ec8797
SHA1bf7f6848a0b32518c77fb9b8303a74758d95e680
SHA2569621186a6c83251ce5ace1fc16d3ea636ae22dc2649c16d75a376e165541352d
SHA5121c96d042135d0dacd91c694780fe8dd0145023890fe054a53082957c98ed98ad745528514679954c96d21779e75b0a484a6c6aeac48f0e589a98e1d1751e9644
-
\Users\Admin\AppData\Local\Temp\nsy4FF6.tmp\vivo.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
memory/2660-41-0x0000000000570000-0x000000000057B000-memory.dmpFilesize
44KB
-
memory/2876-11-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmpFilesize
9.6MB
-
memory/2876-10-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmpFilesize
9.6MB
-
memory/2876-16-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmpFilesize
9.6MB
-
memory/2876-9-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmpFilesize
9.6MB
-
memory/2876-8-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmpFilesize
9.6MB
-
memory/2876-4-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmpFilesize
4KB
-
memory/2876-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmpFilesize
32KB
-
memory/2876-7-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmpFilesize
9.6MB
-
memory/2876-5-0x000000001B600000-0x000000001B8E2000-memory.dmpFilesize
2.9MB
-
memory/4716-10047-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB