Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:51
Static task
static1
Behavioral task
behavioral1
Sample
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
690dea8b1e5230f1539d8df4d3b298b3
-
SHA1
39dcfc1b0c2edccbab807512a74283d731616247
-
SHA256
67d835eb83a752a345c46bd88389980cbed33ebdfaf3b87866d1f7e0264f2171
-
SHA512
7dbbfca3cd229aa2b9be944cfc061f905622b48c9eae7d5a42a83a2708e5abcb332a6ec67ac0332a9d4bb5c923fcd11c00345fdf304ee185cf42b72b31c49553
-
SSDEEP
24576:lWl2/dAjOI9ynxM0/qWJRWajidS4WhA/q:cOCynx4Wyajr4WhQq
Malware Config
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3160-8-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral2/memory/3776-22-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/3776-24-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/3776-25-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3160-8-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral2/memory/1528-27-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1528-29-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1528-30-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1528-38-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-8-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral2/memory/3776-22-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3776-24-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/3776-25-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1528-27-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1528-29-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1528-30-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1528-38-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 whatismyipaddress.com 31 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exedescription pid process target process PID 3792 set thread context of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3160 set thread context of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 set thread context of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 1528 vbc.exe 1528 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe Token: SeDebugPrivilege 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exepid process 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exedescription pid process target process PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3792 wrote to memory of 3160 3792 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 3776 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe PID 3160 wrote to memory of 1528 3160 690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\690dea8b1e5230f1539d8df4d3b298b3_JaffaCakes118.exe.logFilesize
902B
MD584cda476d23ba49602e40f063fede198
SHA15eeeab741e5e5473eed158a46ea8178687acfb7e
SHA25668180195fdef699ce7597117481b67f77e35b78cbe2a563412f90c28dd9c1e12
SHA5125c9a2d6e507d41fd634531cdbfecb0fe17a0a4d597bbb7e0e8f82155b447e741610a5cdc39cf5203fb95a388bb068cfbd51f11dcb5ce337071930d89b6c50d8c
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
memory/1528-38-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1528-36-0x0000000000460000-0x0000000000529000-memory.dmpFilesize
804KB
-
memory/1528-30-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1528-29-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1528-27-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3160-14-0x0000000004F70000-0x0000000004F7A000-memory.dmpFilesize
40KB
-
memory/3160-21-0x0000000008BE0000-0x0000000008BE8000-memory.dmpFilesize
32KB
-
memory/3160-40-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3160-39-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3160-12-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3160-13-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3160-15-0x00000000050A0000-0x00000000050F6000-memory.dmpFilesize
344KB
-
memory/3160-8-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/3160-18-0x0000000008680000-0x00000000086E6000-memory.dmpFilesize
408KB
-
memory/3776-24-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3776-22-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3776-25-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3792-0-0x00000000744BE000-0x00000000744BF000-memory.dmpFilesize
4KB
-
memory/3792-6-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB
-
memory/3792-5-0x0000000004EA0000-0x0000000004EBC000-memory.dmpFilesize
112KB
-
memory/3792-4-0x0000000007A50000-0x0000000007B00000-memory.dmpFilesize
704KB
-
memory/3792-3-0x0000000004EF0000-0x0000000004F82000-memory.dmpFilesize
584KB
-
memory/3792-2-0x00000000054A0000-0x0000000005A44000-memory.dmpFilesize
5.6MB
-
memory/3792-1-0x0000000000430000-0x0000000000540000-memory.dmpFilesize
1.1MB
-
memory/3792-7-0x0000000008AF0000-0x0000000008B8C000-memory.dmpFilesize
624KB
-
memory/3792-11-0x00000000744B0000-0x0000000074C60000-memory.dmpFilesize
7.7MB