c4a4f048d4a44b2a9b7eb7c7e4881198829ce220d49dc7ee96e24be3d9043aec

Analysis

max time kernel
148s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe
Size 338KB
Sample240522-bfwadaff4z
SHA256 c4a4f048d4a44b2a9b7eb7c7e4881198829ce220d49dc7ee96e24be3d9043aec
MD5 6574e4a7db94521146cdff1e0756ec80
SHA1 8b2a05ca53cbffe0cae4af26fb5a1d2073d761e1
SHA512 bae8a27073de0023c8d6bacf5dfe0ab68194874931159e1104a2780f2746981ef639085c42d100776b99f580563251043a131d06370543adf32a027c2c9dd6e1
SSDEEP 6144:2NLW6ZBGyzW/NLOtcX7DUtF3bcWBVPh/aghiahXS6oNNLaXIYE:Mi6ZEJYKc3gASpqyNNqDE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 980 set thread context of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1640	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe
1640	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1640	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83
PID 980 wrote to memory of 1640	980	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:980
- C:\Users\Admin\AppData\Local\Temp\6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\6574e4a7db94521146cdff1e0756ec80_JaffaCakes118.exe.log
Size 224B
SHA256 42f723d18283fda6a0904046cc29ee8d10e562d20c7615259a46ae9c0e4c9708
MD5 9c4b66f77f12558c48b620ddfb44029d
SHA1 446651db643b943ec37b9b3599655e211a4bc73e
SHA512 983aed0ec15a79b716ac6dc080146e4ed098c117c31167053fb5971649dc621d1db5292fdd76f3010f094b75d57ea0bdb35bc829c6ba37e4d276b266361dee8e
MD5 SHA1 SHA512

Submit Download

security.config.cch

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
Size 478B
SHA256 fec7e78800f9f12d1e66da217270b655fb5f951e8ce7fd92b0e379dd3f020086
MD5 8605b5aeeccfdc5eb1a9a58c7bc07374
SHA1 2e39c0c3a59664dcf575c6f8c8c57a86a4638286
SHA512 215b923d776f1bba2a1827b87a676deb966afe22b889e74dcadabcad9d8cdf159dcfa02b253996a3862b6e86fa35372d0be946a8abcbcb71f165f3c2e9f323ba
MD5 SHA1 SHA512

Submit Download

memory/980-13-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/980-1-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/980-2-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/980-0-0x00000000754B2000-0x00000000754B3000-memory.dmp

Download

memory/980-9-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/1640-3-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1640-10-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/1640-14-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/1640-15-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/1640-16-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download

memory/1640-17-0x00000000754B0000-0x0000000075A61000-memory.dmp

Download