Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe
-
Size
720KB
-
MD5
4b18775ec7b1d8359e7aa9c72d6cec2a
-
SHA1
7e45e41a8725842b1ca5a69910acf6cf344b9a3f
-
SHA256
3fceddef72a3dc094c668e1abe7de842afe815d4f56f1cc530e4165ad32d3484
-
SHA512
7333c987a90e7a99498099499a2e02e3690d29e683ae5425daef83e458eb00fc8f5a3c23c7cf4ab10ea768358116711785f0685283795a8a75cc9b55a9396269
-
SSDEEP
12288:nrfv5g+OFLHuqgRpIgFHjnzk8/WcmQz0af2GbKepaRBwkYo8KjkZahMeJjdIbDuo:rfve+OFLHuHRpIEHjo8uiZfHKbRiJo83
Malware Config
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2472-9-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2472-11-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2472-12-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2472-13-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/2512-18-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/2512-14-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/2512-16-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/2512-22-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2472-9-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2472-11-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2472-12-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2472-13-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2512-18-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/2512-14-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/2512-16-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/2512-22-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 whatismyipaddress.com 7 whatismyipaddress.com 4 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exedescription pid Process procid_target PID 2528 set thread context of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 set thread context of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exepid Process 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exedescription pid Process Token: SeDebugPrivilege 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exepid Process 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exedescription pid Process procid_target PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2472 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2512 2528 4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4b18775ec7b1d8359e7aa9c72d6cec2a_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"2⤵
- Accesses Microsoft Outlook accounts
PID:2472
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"2⤵PID:2512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84