Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 18:20

General

  • Target

    5624fb2ed41f989f2d2e38579fa3a17b_JaffaCakes118.exe

  • Size

    520KB

  • MD5

    5624fb2ed41f989f2d2e38579fa3a17b

  • SHA1

    2e3fd2be2b88a35837f29a927086abb430e12a4a

  • SHA256

    17dc0136c31a1353dd87efd7cabb4b7c39afb3b26e016e92f2e87feec62e4aa4

  • SHA512

    c458026e6d52c8cd486772b21fa7772fcd415c7333461176d084bafee43162d1eef73e922146d50aeb3c857292c176c8215aa57a8986caaed544fed86a160ec8

  • SSDEEP

    12288:pDWFBsvRPY6VyvEIKAVPZTHyjo6ItTKBYXWRgHc0GDE5CoG:RvRgOyhaXIZuYXWRd4G

Malware Config

Signatures

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5624fb2ed41f989f2d2e38579fa3a17b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5624fb2ed41f989f2d2e38579fa3a17b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Users\Admin\AppData\Local\Temp\5624fb2ed41f989f2d2e38579fa3a17b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5624fb2ed41f989f2d2e38579fa3a17b_JaffaCakes118.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1844

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5624fb2ed41f989f2d2e38579fa3a17b_JaffaCakes118.exe.log

          Filesize

          522B

          MD5

          0f39d6b9afc039d81ff31f65cbf76826

          SHA1

          8356d04fe7bba2695d59b6caf5c59f58f3e1a6d8

          SHA256

          ea16b63ffd431ebf658b903710b6b3a9b8a2eb6814eee3a53b707a342780315d

          SHA512

          5bad54adb2e32717ef6275f49e2f101dd7e2011c9be14a32e5c29051e8a3f608cbd0b44ac4855ab21e790cb7a5d84c5f69de087074fd01b35259d34d07f5aaf9

        • memory/1844-10-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

        • memory/1844-13-0x0000000005C00000-0x0000000005C18000-memory.dmp

          Filesize

          96KB

        • memory/1844-19-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

        • memory/1844-18-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

        • memory/1844-17-0x00000000074F0000-0x00000000074FA000-memory.dmp

          Filesize

          40KB

        • memory/1844-9-0x00000000057F0000-0x0000000005882000-memory.dmp

          Filesize

          584KB

        • memory/1844-12-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

        • memory/1844-16-0x0000000007480000-0x00000000074D0000-memory.dmp

          Filesize

          320KB

        • memory/1844-15-0x0000000006FA0000-0x0000000006FAA000-memory.dmp

          Filesize

          40KB

        • memory/1844-8-0x0000000005D00000-0x00000000062A4000-memory.dmp

          Filesize

          5.6MB

        • memory/1844-14-0x00000000063F0000-0x0000000006456000-memory.dmp

          Filesize

          408KB

        • memory/1844-4-0x0000000000400000-0x0000000000438000-memory.dmp

          Filesize

          224KB

        • memory/3388-1-0x00000000001F0000-0x0000000000278000-memory.dmp

          Filesize

          544KB

        • memory/3388-2-0x0000000004C60000-0x0000000004CFC000-memory.dmp

          Filesize

          624KB

        • memory/3388-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

          Filesize

          4KB

        • memory/3388-11-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

        • memory/3388-7-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

        • memory/3388-3-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB