Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 09:45
Static task
static1
Behavioral task
behavioral1
Sample
39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi
-
Size
276KB
-
MD5
39785a54266c4913b1c742438a591dd0
-
SHA1
f9420bc46643a0257bc64b05bb584db01a0d2eb2
-
SHA256
f2a8196758ba541344e90a320f4c01d93e83aae305d6dfde5d96f6444cf30a5f
-
SHA512
4f4b75134ad2a2d97447dda49440b81ebe72870901066fa5319f7144102b781efd2e339d6ef516a45a5761f7e51a9f13b0befd8a31cf07c6b15939e2d689e7cb
-
SSDEEP
6144:3E0yyMaPnpTFg3c4LR5BodhWWYR6gn6CyFlo5s+CG9FsEpkKBFaPwdg:3E8pvpTFOXN5wWpUrmC4DR3ao
Malware Config
Extracted
lokibot
http://adrack.us/wp-admin/css/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook MSI7502.tmp Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSI7502.tmp Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSI7502.tmp -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3028 set thread context of 1328 3028 MSI7502.tmp 95 -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5773f7.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSI74B3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7502.tmp msiexec.exe File created C:\Windows\Installer\e5773f7.msi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 3028 MSI7502.tmp 1328 MSI7502.tmp -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9712a8ab103c3e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9712a8a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9712a8a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9712a8a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9712a8a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4016 msiexec.exe 4016 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 3688 msiexec.exe Token: SeIncreaseQuotaPrivilege 3688 msiexec.exe Token: SeSecurityPrivilege 4016 msiexec.exe Token: SeCreateTokenPrivilege 3688 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3688 msiexec.exe Token: SeLockMemoryPrivilege 3688 msiexec.exe Token: SeIncreaseQuotaPrivilege 3688 msiexec.exe Token: SeMachineAccountPrivilege 3688 msiexec.exe Token: SeTcbPrivilege 3688 msiexec.exe Token: SeSecurityPrivilege 3688 msiexec.exe Token: SeTakeOwnershipPrivilege 3688 msiexec.exe Token: SeLoadDriverPrivilege 3688 msiexec.exe Token: SeSystemProfilePrivilege 3688 msiexec.exe Token: SeSystemtimePrivilege 3688 msiexec.exe Token: SeProfSingleProcessPrivilege 3688 msiexec.exe Token: SeIncBasePriorityPrivilege 3688 msiexec.exe Token: SeCreatePagefilePrivilege 3688 msiexec.exe Token: SeCreatePermanentPrivilege 3688 msiexec.exe Token: SeBackupPrivilege 3688 msiexec.exe Token: SeRestorePrivilege 3688 msiexec.exe Token: SeShutdownPrivilege 3688 msiexec.exe Token: SeDebugPrivilege 3688 msiexec.exe Token: SeAuditPrivilege 3688 msiexec.exe Token: SeSystemEnvironmentPrivilege 3688 msiexec.exe Token: SeChangeNotifyPrivilege 3688 msiexec.exe Token: SeRemoteShutdownPrivilege 3688 msiexec.exe Token: SeUndockPrivilege 3688 msiexec.exe Token: SeSyncAgentPrivilege 3688 msiexec.exe Token: SeEnableDelegationPrivilege 3688 msiexec.exe Token: SeManageVolumePrivilege 3688 msiexec.exe Token: SeImpersonatePrivilege 3688 msiexec.exe Token: SeCreateGlobalPrivilege 3688 msiexec.exe Token: SeBackupPrivilege 3220 vssvc.exe Token: SeRestorePrivilege 3220 vssvc.exe Token: SeAuditPrivilege 3220 vssvc.exe Token: SeBackupPrivilege 4016 msiexec.exe Token: SeRestorePrivilege 4016 msiexec.exe Token: SeRestorePrivilege 4016 msiexec.exe Token: SeTakeOwnershipPrivilege 4016 msiexec.exe Token: SeRestorePrivilege 4016 msiexec.exe Token: SeTakeOwnershipPrivilege 4016 msiexec.exe Token: SeRestorePrivilege 4016 msiexec.exe Token: SeTakeOwnershipPrivilege 4016 msiexec.exe Token: SeDebugPrivilege 3028 MSI7502.tmp Token: SeRestorePrivilege 4016 msiexec.exe Token: SeTakeOwnershipPrivilege 4016 msiexec.exe Token: SeRestorePrivilege 4016 msiexec.exe Token: SeTakeOwnershipPrivilege 4016 msiexec.exe Token: SeDebugPrivilege 1328 MSI7502.tmp Token: SeBackupPrivilege 3288 srtasks.exe Token: SeRestorePrivilege 3288 srtasks.exe Token: SeSecurityPrivilege 3288 srtasks.exe Token: SeTakeOwnershipPrivilege 3288 srtasks.exe Token: SeBackupPrivilege 3288 srtasks.exe Token: SeRestorePrivilege 3288 srtasks.exe Token: SeSecurityPrivilege 3288 srtasks.exe Token: SeTakeOwnershipPrivilege 3288 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3688 msiexec.exe 3688 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3288 4016 msiexec.exe 92 PID 4016 wrote to memory of 3288 4016 msiexec.exe 92 PID 4016 wrote to memory of 3028 4016 msiexec.exe 94 PID 4016 wrote to memory of 3028 4016 msiexec.exe 94 PID 4016 wrote to memory of 3028 4016 msiexec.exe 94 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 PID 3028 wrote to memory of 1328 3028 MSI7502.tmp 95 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook MSI7502.tmp -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MSI7502.tmp
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\39785a54266c4913b1c742438a591dd0_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3688
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3288
-
-
C:\Windows\Installer\MSI7502.tmp"C:\Windows\Installer\MSI7502.tmp"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\Installer\MSI7502.tmp"C:\Windows\Installer\MSI7502.tmp"3⤵
- Accesses Microsoft Outlook profiles
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1328
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
663B
MD5f614dc07bbf88dfad9fdf32e19f30a76
SHA1031b2fc7ef4d6f63f0fe876b120737ab38b32618
SHA256a6baabfa20d15c8aa2b0d12b082109afb51ed3e8e9ef572a588f336ed19e31ab
SHA51214febd088b3e9d49b6ccae89a367d38c902db337d1436494ed12626ed7a8184670e0a37b109d9295fced73c0998d8969116794cdf2d20a1e98aa2290f44a25f4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1337824034-2731376981-3755436523-1000\0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1337824034-2731376981-3755436523-1000\0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
Filesize
251KB
MD5f23655ddaed28200f785cfd6198c2618
SHA1fb3d5fba811efc23c16ee6c452bb057500cca175
SHA2560cd20472d51f951c8989abe3482f0297d8c2bbb15a4f4d3db51f4b3ec956b3c9
SHA51235766febf8b316c895a72b03676ac670e3d1f3731b5627c348a1a75832c842ebeca528644974f6778a801d3cc996a5a2cf90348907060fbb84514b27172c9a3d
-
Filesize
23.7MB
MD50e4e22bc0c7edee9f68d2e5a3ae30695
SHA1f267cddeec6bdfcd2b410ef3f81403fb020c2af1
SHA2561ef9d3fce0c82685fad1b6cc06f36c16431add0c4da09a63abb39501fcccdef2
SHA5120b830837da44b8d8f7f86171fef3c01e9fadeff0af1700d82194ff2e9a11f50da3acf3b938d978c5ee99503bb19205a702bd8e1482c3958aabffdb7c97d22e18
-
\??\Volume{8a2a71c9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f06201d2-5394-4c5d-8ab7-9850f92ee74f}_OnDiskSnapshotProp
Filesize6KB
MD5138ac93ab8ee94c360cc69f5bc63fa56
SHA138adfec248230003fab8dde0bd6db709c4c695eb
SHA256c6026ede00dfc2eb5dda719749ef23f0ff9f02ec5f681645a69efaa88479e6eb
SHA5124c161abd7f58eaefe4f49df7876504f84550ad659ad5839449bab0b0223abd92323d1d98cb84bc82c17d77ec26b2abd29edda5b419b580f64eb25775376dc8cf