Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
Resource
win10v2004-20240426-en
General
-
Target
33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps1
-
Size
493KB
-
MD5
33ca486ee889bc38d992e033ea20cb5a
-
SHA1
c26e975dbc222bfdd9a7fd628c9a76d5fb9ed2ec
-
SHA256
d01d56d0488f4286f99b67ea683b80cb85cb1a1740aa92470c3b2466f0ea207a
-
SHA512
7f9055d413103fb0d33383c915fe39d5880fb3c2bc77d2de232388d89cc0d45d865c446a6cee06472863d0b0b70fa431ca217e0a36e1191160864d12c3c8adb2
-
SSDEEP
12288:zZUvZhblII/vlJEzfYT7a19RKXHMyv+A9:zINlIAJM+7mzKbmM
Malware Config
Extracted
lokibot
https://afrisoccer.co.tz/cgi/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
mzq.exepid process 2408 mzq.exe -
Loads dropped DLL 2 IoCs
Processes:
mzq.exepid process 2408 mzq.exe 2408 mzq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook cmd.exe Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmd.exe Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mzq.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WIRE1x (2.5.1) = "\\WIRE1x_2_5_1.exe" mzq.exe -
Drops file in Windows directory 1 IoCs
Processes:
mzq.exedescription ioc process File opened for modification C:\Windows\win.ini mzq.exe -
Processes:
powershell.exepowershell.exepid process 9168 powershell.exe 1312 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exemzq.exepowershell.exepid process 1312 powershell.exe 1312 powershell.exe 2408 mzq.exe 9168 powershell.exe 9168 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
mzq.exepid process 2408 mzq.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execmd.exedescription pid process Token: SeDebugPrivilege 1312 powershell.exe Token: SeDebugPrivilege 9168 powershell.exe Token: SeDebugPrivilege 5408 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
powershell.exemzq.exedescription pid process target process PID 1312 wrote to memory of 2408 1312 powershell.exe mzq.exe PID 1312 wrote to memory of 2408 1312 powershell.exe mzq.exe PID 1312 wrote to memory of 2408 1312 powershell.exe mzq.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe PID 2408 wrote to memory of 5408 2408 mzq.exe cmd.exe -
outlook_office_path 1 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmd.exe -
outlook_win_path 1 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cmd.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\33ca486ee889bc38d992e033ea20cb5a_JaffaCakes118.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\mzq.exe"C:\Users\Public\mzq.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "powershell.exe -command "Set-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\"""2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\""3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e5bfec1063a497048fffb231a0621403
SHA197cf6a89f237f43b9c22e3e081f7d45924d435ba
SHA256325d1ffa65e9593a834f3662168d0c1950de148c63f1e43b86727087f3881d6f
SHA512e38c5189054cf09fb15de017d0bbe226338124ee02bb04530943c8fcfc303dbe5fe5fd28c9c1aea1b552d1a2b0b76cabbedd284a38a07d41ec9cf9e55b44dd0e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ukroiagg.4j1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\bagnios.dllFilesize
136KB
MD5ed9eb10ec841fd7ba6bf475fa6ec8797
SHA1bf7f6848a0b32518c77fb9b8303a74758d95e680
SHA2569621186a6c83251ce5ace1fc16d3ea636ae22dc2649c16d75a376e165541352d
SHA5121c96d042135d0dacd91c694780fe8dd0145023890fe054a53082957c98ed98ad745528514679954c96d21779e75b0a484a6c6aeac48f0e589a98e1d1751e9644
-
C:\Users\Admin\AppData\Local\Temp\nss808C.tmp\vivo.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-711569230-3659488422-571408806-1000\0f5007522459c86e95ffcc62f32308f1_5fd6b8d9-48b3-42c0-adc7-08f9fe7c965eFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Public\mzq.exeFilesize
351KB
MD5748f776174ae1f276549d965f8197ea8
SHA13bb89c7f06784ab2a2a5fdd3e608c3758fddbd57
SHA25692ea1e6f6231537e78636e4a094aeb6b90dea2ca5ea62135b5900fdc080809ac
SHA5123ac408ffb957d8f9392e51faf4d6f2af258ca428ff93d61bcda6cb4a1932929bec285cda9d73d666b6bd1c25be0ca0084ee57f601807b0ce3be225235d4c5e37
-
C:\Windows\win.iniFilesize
131B
MD59848e4efb0abd437d65e6d3d1d973adb
SHA1f427ac7c50b19f66658ae7f92cbaf21110b49a47
SHA256c8b84add37da849977a84fe62badb6cb908be99769edb70d60bcd04c0aec2a3f
SHA512f90f1f65b6b824a526469b8d739f733a54a7f485d8b5f680de7a35fac90786bf6ba5a0b1d62e139663c5ee73b8d687cf32d4ccf188e18c53084ec12d8c216b17
-
memory/1312-9-0x000001FF514B0000-0x000001FF514D2000-memory.dmpFilesize
136KB
-
memory/1312-11-0x00007FFAA3CC0000-0x00007FFAA4781000-memory.dmpFilesize
10.8MB
-
memory/1312-12-0x00007FFAA3CC0000-0x00007FFAA4781000-memory.dmpFilesize
10.8MB
-
memory/1312-18-0x00007FFAA3CC0000-0x00007FFAA4781000-memory.dmpFilesize
10.8MB
-
memory/1312-0-0x00007FFAA3CC3000-0x00007FFAA3CC5000-memory.dmpFilesize
8KB
-
memory/2408-48-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/2408-10050-0x00000000031D0000-0x00000000031F1000-memory.dmpFilesize
132KB
-
memory/2408-47-0x0000000003190000-0x0000000003196000-memory.dmpFilesize
24KB
-
memory/2408-41-0x00000000031B0000-0x00000000031BB000-memory.dmpFilesize
44KB
-
memory/5408-10051-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/5408-10052-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/5408-10053-0x00000000009A0000-0x00000000009A6000-memory.dmpFilesize
24KB
-
memory/5408-10055-0x0000000000990000-0x0000000000993000-memory.dmpFilesize
12KB
-
memory/5408-10056-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/5408-10142-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/9168-10058-0x00000000053C0000-0x00000000059E8000-memory.dmpFilesize
6.2MB
-
memory/9168-10061-0x0000000005BD0000-0x0000000005C36000-memory.dmpFilesize
408KB
-
memory/9168-10071-0x0000000005C40000-0x0000000005F94000-memory.dmpFilesize
3.3MB
-
memory/9168-10060-0x0000000005B60000-0x0000000005BC6000-memory.dmpFilesize
408KB
-
memory/9168-10073-0x00000000061F0000-0x000000000620E000-memory.dmpFilesize
120KB
-
memory/9168-10074-0x0000000006220000-0x000000000626C000-memory.dmpFilesize
304KB
-
memory/9168-10059-0x0000000005230000-0x0000000005252000-memory.dmpFilesize
136KB
-
memory/9168-10119-0x000000006FCE0000-0x000000006FD2C000-memory.dmpFilesize
304KB
-
memory/9168-10118-0x00000000067D0000-0x0000000006802000-memory.dmpFilesize
200KB
-
memory/9168-10129-0x00000000073D0000-0x00000000073EE000-memory.dmpFilesize
120KB
-
memory/9168-10130-0x00000000073F0000-0x0000000007493000-memory.dmpFilesize
652KB
-
memory/9168-10131-0x0000000007B70000-0x00000000081EA000-memory.dmpFilesize
6.5MB
-
memory/9168-10132-0x0000000007520000-0x000000000753A000-memory.dmpFilesize
104KB
-
memory/9168-10133-0x0000000007590000-0x000000000759A000-memory.dmpFilesize
40KB
-
memory/9168-10134-0x00000000077A0000-0x0000000007836000-memory.dmpFilesize
600KB
-
memory/9168-10135-0x0000000007720000-0x0000000007731000-memory.dmpFilesize
68KB
-
memory/9168-10136-0x0000000007750000-0x000000000775E000-memory.dmpFilesize
56KB
-
memory/9168-10137-0x0000000007760000-0x0000000007774000-memory.dmpFilesize
80KB
-
memory/9168-10138-0x0000000007860000-0x000000000787A000-memory.dmpFilesize
104KB
-
memory/9168-10139-0x0000000007840000-0x0000000007848000-memory.dmpFilesize
32KB
-
memory/9168-10057-0x0000000002C30000-0x0000000002C66000-memory.dmpFilesize
216KB