Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 09:45
Static task
static1
Behavioral task
behavioral1
Sample
39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi
-
Size
276KB
-
MD5
39785a54266c4913b1c742438a591dd0
-
SHA1
f9420bc46643a0257bc64b05bb584db01a0d2eb2
-
SHA256
f2a8196758ba541344e90a320f4c01d93e83aae305d6dfde5d96f6444cf30a5f
-
SHA512
4f4b75134ad2a2d97447dda49440b81ebe72870901066fa5319f7144102b781efd2e339d6ef516a45a5761f7e51a9f13b0befd8a31cf07c6b15939e2d689e7cb
-
SSDEEP
6144:3E0yyMaPnpTFg3c4LR5BodhWWYR6gn6CyFlo5s+CG9FsEpkKBFaPwdg:3E8pvpTFOXN5wWpUrmC4DR3ao
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://adrack.us/wp-admin/css/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSIEADE.tmp Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MSIEADE.tmp Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSIEADE.tmp -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1200 set thread context of 3020 1200 MSIEADE.tmp 35 -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIEADE.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76e7b3.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f76e7b3.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIEA4F.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76e7b0.msi msiexec.exe File opened for modification C:\Windows\Installer\f76e7b0.msi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 1200 MSIEADE.tmp 3020 MSIEADE.tmp -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3028 msiexec.exe 3028 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 1708 msiexec.exe Token: SeIncreaseQuotaPrivilege 1708 msiexec.exe Token: SeRestorePrivilege 3028 msiexec.exe Token: SeTakeOwnershipPrivilege 3028 msiexec.exe Token: SeSecurityPrivilege 3028 msiexec.exe Token: SeCreateTokenPrivilege 1708 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1708 msiexec.exe Token: SeLockMemoryPrivilege 1708 msiexec.exe Token: SeIncreaseQuotaPrivilege 1708 msiexec.exe Token: SeMachineAccountPrivilege 1708 msiexec.exe Token: SeTcbPrivilege 1708 msiexec.exe Token: SeSecurityPrivilege 1708 msiexec.exe Token: SeTakeOwnershipPrivilege 1708 msiexec.exe Token: SeLoadDriverPrivilege 1708 msiexec.exe Token: SeSystemProfilePrivilege 1708 msiexec.exe Token: SeSystemtimePrivilege 1708 msiexec.exe Token: SeProfSingleProcessPrivilege 1708 msiexec.exe Token: SeIncBasePriorityPrivilege 1708 msiexec.exe Token: SeCreatePagefilePrivilege 1708 msiexec.exe Token: SeCreatePermanentPrivilege 1708 msiexec.exe Token: SeBackupPrivilege 1708 msiexec.exe Token: SeRestorePrivilege 1708 msiexec.exe Token: SeShutdownPrivilege 1708 msiexec.exe Token: SeDebugPrivilege 1708 msiexec.exe Token: SeAuditPrivilege 1708 msiexec.exe Token: SeSystemEnvironmentPrivilege 1708 msiexec.exe Token: SeChangeNotifyPrivilege 1708 msiexec.exe Token: SeRemoteShutdownPrivilege 1708 msiexec.exe Token: SeUndockPrivilege 1708 msiexec.exe Token: SeSyncAgentPrivilege 1708 msiexec.exe Token: SeEnableDelegationPrivilege 1708 msiexec.exe Token: SeManageVolumePrivilege 1708 msiexec.exe Token: SeImpersonatePrivilege 1708 msiexec.exe Token: SeCreateGlobalPrivilege 1708 msiexec.exe Token: SeBackupPrivilege 2944 vssvc.exe Token: SeRestorePrivilege 2944 vssvc.exe Token: SeAuditPrivilege 2944 vssvc.exe Token: SeBackupPrivilege 3028 msiexec.exe Token: SeRestorePrivilege 3028 msiexec.exe Token: SeRestorePrivilege 2488 DrvInst.exe Token: SeRestorePrivilege 2488 DrvInst.exe Token: SeRestorePrivilege 2488 DrvInst.exe Token: SeRestorePrivilege 2488 DrvInst.exe Token: SeRestorePrivilege 2488 DrvInst.exe Token: SeRestorePrivilege 2488 DrvInst.exe Token: SeRestorePrivilege 2488 DrvInst.exe Token: SeLoadDriverPrivilege 2488 DrvInst.exe Token: SeLoadDriverPrivilege 2488 DrvInst.exe Token: SeLoadDriverPrivilege 2488 DrvInst.exe Token: SeRestorePrivilege 3028 msiexec.exe Token: SeTakeOwnershipPrivilege 3028 msiexec.exe Token: SeRestorePrivilege 3028 msiexec.exe Token: SeTakeOwnershipPrivilege 3028 msiexec.exe Token: SeRestorePrivilege 3028 msiexec.exe Token: SeTakeOwnershipPrivilege 3028 msiexec.exe Token: SeRestorePrivilege 3028 msiexec.exe Token: SeTakeOwnershipPrivilege 3028 msiexec.exe Token: SeDebugPrivilege 1200 MSIEADE.tmp Token: SeRestorePrivilege 3028 msiexec.exe Token: SeTakeOwnershipPrivilege 3028 msiexec.exe Token: SeRestorePrivilege 3028 msiexec.exe Token: SeTakeOwnershipPrivilege 3028 msiexec.exe Token: SeDebugPrivilege 3020 MSIEADE.tmp -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1708 msiexec.exe 1708 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3028 wrote to memory of 1200 3028 msiexec.exe 34 PID 3028 wrote to memory of 1200 3028 msiexec.exe 34 PID 3028 wrote to memory of 1200 3028 msiexec.exe 34 PID 3028 wrote to memory of 1200 3028 msiexec.exe 34 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 PID 1200 wrote to memory of 3020 1200 MSIEADE.tmp 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSIEADE.tmp -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSIEADE.tmp
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1708
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\Installer\MSIEADE.tmp"C:\Windows\Installer\MSIEADE.tmp"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\Installer\MSIEADE.tmp"C:\Windows\Installer\MSIEADE.tmp"3⤵
- Accesses Microsoft Outlook profiles
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3020
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D8" "000000000000059C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
663B
MD5a3bfa7f773ddeff39b2db7d87d53d831
SHA120a4d6acc55e984823b603e3ce368b3470bb920b
SHA256bca04c7f2bc13036901a31efea2c71944523eda8ad2a64756a29d54fdeda9054
SHA5126231408c4a7fed14e07e67d84dab1f59f3fd4515c8fa312900d2e447c118862ecbef1c2a5a460298464981cd126bacb1d7aadf24d2c6e29149f5349a90be20d3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
Filesize
251KB
MD5f23655ddaed28200f785cfd6198c2618
SHA1fb3d5fba811efc23c16ee6c452bb057500cca175
SHA2560cd20472d51f951c8989abe3482f0297d8c2bbb15a4f4d3db51f4b3ec956b3c9
SHA51235766febf8b316c895a72b03676ac670e3d1f3731b5627c348a1a75832c842ebeca528644974f6778a801d3cc996a5a2cf90348907060fbb84514b27172c9a3d