Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 03:56

General

  • Target

    5d0fc29b2e452f2755adb485b042b68f_JaffaCakes118.exe

  • Size

    749KB

  • MD5

    5d0fc29b2e452f2755adb485b042b68f

  • SHA1

    b593df766e097fcd883283449021b0929d2789bf

  • SHA256

    14238c034c6094c578678f2f9ace098c16b3c0330b2205a79bb0d6dc87ee4ad7

  • SHA512

    3e5f0beb9e2c379a28721c7b0ffbccf56bf3789c78be585a09eed274bc45f97d84d063be42cfeb6eebbaae8969e9676d8d8587efadefcef0a751d8db4f3c1c4b

  • SSDEEP

    12288:r2ao6kbriwUzgTVyaFBA8KBcm3VDSxUoe7+PL1BLltrcxoIlrh4Xxw0nOJaL4Lh:r2aOriwwmVb08wcm3VGmoegLvvI9OqHZ

Score
9/10

Malware Config

Signatures

  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 8 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d0fc29b2e452f2755adb485b042b68f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5d0fc29b2e452f2755adb485b042b68f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\5d0fc29b2e452f2755adb485b042b68f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5d0fc29b2e452f2755adb485b042b68f_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp274A.tmp"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:6136
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2B52.tmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:5852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\5d0fc29b2e452f2755adb485b042b68f_JaffaCakes118.exe.log

    Filesize

    405B

    MD5

    bb02d2315b8c3d46390cc8852c350909

    SHA1

    c7eb57165fb7be0cec9a282a56449d35a3e39a53

    SHA256

    6b04fbf03b5064dc32c8cbc7e5f125339ca297622487ed4269da381fa50b7290

    SHA512

    e395ec8866c9ba864bd59bfb84a88538a053740d66e2fa83926597b2e4b357a55f794c5b39c5ae43353f4debc865ec6b4c60494da32a10e643582b6ae130d080

  • C:\Users\Admin\AppData\Local\Temp\tmp274A.tmp

    Filesize

    4KB

    MD5

    a35b8711bea28d54fb7a350adceb3f76

    SHA1

    5872d7a95a74ec6de08194283027fcf2cdb96390

    SHA256

    a90449e696cb37fa289ab8dcd0888734c74d0b61273231a0ce0e93adfd2d8137

    SHA512

    d997e0ace25eff648f16395a4771402465b39fa059d3b0f36efbd743c691bf4308c58d5585e3aebc63c206d18d01edf46f14b0cb5cffe6f1d5bf9132d76d9210

  • memory/2956-9-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/2956-11-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/2956-10-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/2956-30-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/3008-1-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/3008-2-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/3008-3-0x0000000075152000-0x0000000075153000-memory.dmp

    Filesize

    4KB

  • memory/3008-4-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/3008-8-0x0000000075150000-0x0000000075701000-memory.dmp

    Filesize

    5.7MB

  • memory/3008-0-0x0000000075152000-0x0000000075153000-memory.dmp

    Filesize

    4KB

  • memory/5852-23-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/5852-25-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/5852-26-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/5852-29-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/5852-27-0x0000000000420000-0x00000000004E9000-memory.dmp

    Filesize

    804KB

  • memory/6136-21-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/6136-16-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/6136-15-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/6136-13-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB