Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 12:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe
-
Size
941KB
-
MD5
54ac0ba851bc399367093c9a74d7ea64
-
SHA1
f5cce6d812890add46c34ef18d773f7d2c1d1032
-
SHA256
496f26beb33fff369de4e425a51670236f669a0db67be31760363407cb3494ba
-
SHA512
bda3bc20c2137efe5bb3da0d0fc25e4014113337d12b419a684a33dcad1efbe7c543a7ff8f6c4f87ed3931b8f9bca94292b827174eb485592697e7944b12b564
-
SSDEEP
12288:XQbhex2teM2Lfzpl6+fcZfcNp3nCoKzN2GwH+lw+3ADMJl5MhNAulRCFx3LEo+C:2h1n2Ltlpm+x/KK+6ILL9f
Score
10/10
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 8 IoCs
resource yara_rule behavioral2/memory/2120-20-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/2120-37-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/2120-36-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/2120-39-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/2120-24-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/2120-23-0x0000000000A70000-0x0000000000B0A000-memory.dmp family_masslogger behavioral2/memory/2120-21-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/2120-22-0x0000000000A70000-0x0000000000B0A000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation hihsdjis.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe -
Executes dropped EXE 3 IoCs
pid Process 4208 hihsdjis.exe 2120 hihsdjis.exe 3872 hihsdjis.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2120-20-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2120-19-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2120-24-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2120-21-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/2120-16-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hihsdjis.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hihsdjis.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hihsdjis.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4208 set thread context of 2120 4208 hihsdjis.exe 85 -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\appdata\hihsdjis.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2120 hihsdjis.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2576 54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe 2576 54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe 4208 hihsdjis.exe 4208 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe 3872 hihsdjis.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4208 hihsdjis.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2120 hihsdjis.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2120 hihsdjis.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1624 2576 54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe 83 PID 2576 wrote to memory of 1624 2576 54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe 83 PID 2576 wrote to memory of 1624 2576 54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe 83 PID 2576 wrote to memory of 1624 2576 54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe 83 PID 2576 wrote to memory of 1624 2576 54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe 83 PID 1624 wrote to memory of 4208 1624 notepad.exe 84 PID 1624 wrote to memory of 4208 1624 notepad.exe 84 PID 1624 wrote to memory of 4208 1624 notepad.exe 84 PID 4208 wrote to memory of 2120 4208 hihsdjis.exe 85 PID 4208 wrote to memory of 2120 4208 hihsdjis.exe 85 PID 4208 wrote to memory of 2120 4208 hihsdjis.exe 85 PID 4208 wrote to memory of 3872 4208 hihsdjis.exe 86 PID 4208 wrote to memory of 3872 4208 hihsdjis.exe 86 PID 4208 wrote to memory of 3872 4208 hihsdjis.exe 86 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hihsdjis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54ac0ba851bc399367093c9a74d7ea64_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Roaming\appdata\hihsdjis.exe"C:\Users\Admin\AppData\Roaming\appdata\hihsdjis.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Roaming\appdata\hihsdjis.exe"C:\Users\Admin\AppData\Roaming\appdata\hihsdjis.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2120
-
-
C:\Users\Admin\AppData\Roaming\appdata\hihsdjis.exe"C:\Users\Admin\AppData\Roaming\appdata\hihsdjis.exe" 2 2120 2406031404⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3872
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
941KB
MD554ac0ba851bc399367093c9a74d7ea64
SHA1f5cce6d812890add46c34ef18d773f7d2c1d1032
SHA256496f26beb33fff369de4e425a51670236f669a0db67be31760363407cb3494ba
SHA512bda3bc20c2137efe5bb3da0d0fc25e4014113337d12b419a684a33dcad1efbe7c543a7ff8f6c4f87ed3931b8f9bca94292b827174eb485592697e7944b12b564