Analysis

  • max time kernel
    142s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18/05/2024, 14:33

General

  • Target

    5534d71175a8ddc713bd487ad3c4e4ab_JaffaCakes118.exe

  • Size

    739KB

  • MD5

    5534d71175a8ddc713bd487ad3c4e4ab

  • SHA1

    d2bf7ba7e59cef3c1b8556b44c9f1ad2845addf4

  • SHA256

    4d6a4c556af5a4e4a05ca5aadb976af1f792bb509cd17cf26aa2ca3081317e3c

  • SHA512

    4630b46d04dd8d305b7102b0207ea0210b3fb50400e9dfcd39eaaa711e9860ca041e13d04e7b9cbc67d28462aea6282ae5d55ba6f404cdfc5aa92ee034bb7730

  • SSDEEP

    12288:Vqov2zv1grOWAOx/+jbY7GTj/YKU/pQ8mvNvbnayPu1N0xH9jsu:Vi2rOnO+jsiTzfU/pQ8cNToN0xdjs

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    QUecleanwx@22#

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5534d71175a8ddc713bd487ad3c4e4ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5534d71175a8ddc713bd487ad3c4e4ab_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nqOncxA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9888.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2780
    • C:\Users\Admin\AppData\Local\Temp\5534d71175a8ddc713bd487ad3c4e4ab_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5534d71175a8ddc713bd487ad3c4e4ab_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2184

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp9888.tmp

          Filesize

          1KB

          MD5

          e9ed6cc5ef2658b8b8eda50f9783ee87

          SHA1

          96cd7521ffb2fda75f69e1d8c3633e6a91a93c83

          SHA256

          23a160b97ce65b43881ad0a962b4ead8c112aee88148cfa0a818fbaf4e35e844

          SHA512

          023fa49364d45f314947f1aa32bb1863ce7f2613a2dad7d2f886dcd678c9b8533b00c1e5b2358d3e11d09bc7fc49828b11221ceb260ba87d77823aee08c54b95

        • memory/2060-8-0x0000000004F40000-0x0000000004F7E000-memory.dmp

          Filesize

          248KB

        • memory/2060-27-0x0000000074060000-0x000000007474E000-memory.dmp

          Filesize

          6.9MB

        • memory/2060-2-0x0000000074060000-0x000000007474E000-memory.dmp

          Filesize

          6.9MB

        • memory/2060-4-0x000000007406E000-0x000000007406F000-memory.dmp

          Filesize

          4KB

        • memory/2060-5-0x0000000074060000-0x000000007474E000-memory.dmp

          Filesize

          6.9MB

        • memory/2060-6-0x0000000004D20000-0x0000000004D7E000-memory.dmp

          Filesize

          376KB

        • memory/2060-7-0x0000000000C30000-0x0000000000C36000-memory.dmp

          Filesize

          24KB

        • memory/2060-0-0x000000007406E000-0x000000007406F000-memory.dmp

          Filesize

          4KB

        • memory/2060-3-0x0000000000540000-0x0000000000558000-memory.dmp

          Filesize

          96KB

        • memory/2060-1-0x0000000000DD0000-0x0000000000E8E000-memory.dmp

          Filesize

          760KB

        • memory/2184-18-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2184-26-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2184-24-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2184-22-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2184-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2184-19-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2184-16-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2184-15-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB