Analysis
-
max time kernel
137s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe
-
Size
883KB
-
MD5
621bbd51e44db9b507a911ceba8c6e4d
-
SHA1
524a771f04ee76bddc16d5a6c0d59ac4f97b3398
-
SHA256
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
-
SHA512
b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
-
SSDEEP
24576:xCDIvM+NgeFi4kQOZiAIxAhlmA35AtbeHFnb:xCDknZi+x/NS
Malware Config
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/4512-22-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral2/memory/5112-33-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/5112-34-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/5112-36-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4512-22-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral2/memory/3684-37-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/3684-38-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/3684-45-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4512-22-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral2/memory/5112-33-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/5112-34-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/5112-36-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3684-37-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/3684-38-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/3684-45-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
Project224.exeProject224.exepid process 2960 Project224.exe 4512 Project224.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Project224.exeProject224.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Documents\\Project224.exe -boot" Project224.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Project224.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 whatismyipaddress.com 45 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Project224.exeProject224.exedescription pid process target process PID 2960 set thread context of 4512 2960 Project224.exe Project224.exe PID 4512 set thread context of 5112 4512 Project224.exe vbc.exe PID 4512 set thread context of 3684 4512 Project224.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 3684 vbc.exe 3684 vbc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exeProject224.exeProject224.exedescription pid process Token: SeDebugPrivilege 4480 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe Token: SeDebugPrivilege 2960 Project224.exe Token: SeDebugPrivilege 4512 Project224.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Project224.exepid process 4512 Project224.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.execmd.exeProject224.exeProject224.exedescription pid process target process PID 4480 wrote to memory of 1304 4480 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe cmd.exe PID 4480 wrote to memory of 1304 4480 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe cmd.exe PID 4480 wrote to memory of 1304 4480 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe cmd.exe PID 4480 wrote to memory of 1612 4480 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe cmd.exe PID 4480 wrote to memory of 1612 4480 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe cmd.exe PID 4480 wrote to memory of 1612 4480 621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 2960 1612 cmd.exe Project224.exe PID 1612 wrote to memory of 2960 1612 cmd.exe Project224.exe PID 1612 wrote to memory of 2960 1612 cmd.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 2960 wrote to memory of 4512 2960 Project224.exe Project224.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 5112 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe PID 4512 wrote to memory of 3684 4512 Project224.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\621bbd51e44db9b507a911ceba8c6e4d_JaffaCakes118.exe" "C:\Users\Admin\Documents\Project224.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Documents\Project224.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Project224.exe"C:\Users\Admin\Documents\Project224.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Project224.exe"C:\Users\Admin\Documents\Project224.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3180 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\Documents\Project224.exeFilesize
883KB
MD5621bbd51e44db9b507a911ceba8c6e4d
SHA1524a771f04ee76bddc16d5a6c0d59ac4f97b3398
SHA2565568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
SHA512b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
-
memory/2960-18-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/2960-25-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/2960-21-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/2960-20-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/2960-19-0x0000000006630000-0x00000000066CC000-memory.dmpFilesize
624KB
-
memory/2960-17-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/3684-45-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3684-44-0x0000000000460000-0x0000000000529000-memory.dmpFilesize
804KB
-
memory/3684-38-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3684-37-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4480-7-0x0000000005900000-0x000000000590A000-memory.dmpFilesize
40KB
-
memory/4480-5-0x00000000054C0000-0x00000000054DE000-memory.dmpFilesize
120KB
-
memory/4480-9-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/4480-8-0x0000000074F0E000-0x0000000074F0F000-memory.dmpFilesize
4KB
-
memory/4480-0-0x0000000074F0E000-0x0000000074F0F000-memory.dmpFilesize
4KB
-
memory/4480-16-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/4480-6-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/4480-1-0x00000000009F0000-0x0000000000AD6000-memory.dmpFilesize
920KB
-
memory/4480-2-0x0000000005A00000-0x0000000005FA4000-memory.dmpFilesize
5.6MB
-
memory/4480-3-0x00000000054F0000-0x0000000005582000-memory.dmpFilesize
584KB
-
memory/4480-4-0x0000000005590000-0x0000000005640000-memory.dmpFilesize
704KB
-
memory/4512-22-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/4512-32-0x0000000009270000-0x0000000009278000-memory.dmpFilesize
32KB
-
memory/4512-29-0x0000000008F80000-0x0000000008FE6000-memory.dmpFilesize
408KB
-
memory/4512-26-0x0000000005A80000-0x0000000005AD6000-memory.dmpFilesize
344KB
-
memory/5112-36-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/5112-34-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/5112-33-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB