Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:58
Static task
static1
Behavioral task
behavioral1
Sample
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
-
Size
395KB
-
MD5
6c8b4064ab664708e7723cb1aad27294
-
SHA1
2d525542f95fdc8a4a93793f5780101ae65ce5fa
-
SHA256
ee279c6b7a4debbd93a6aea65ad694d611fd54865a4af2afe304a284d13fa633
-
SHA512
57eabf864ebaa9b1265b23077c0b11c1b79a7f27e632ff8c755a153765423119526fc63077452bd452c4b9236668c8ce331b4fd96fb751e215e8e73939cd70a0
-
SSDEEP
6144:wJZj3XBjlkq27zgxR3pB/PtLwag4j1vkF5vaa2HjUSpu:4zZo7cv5BXdwafkFVaRH
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1160330796:AAF3SAwgW-OTi9M5kDhSZUlENwhKRvFOWe8/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/484-219-0x0000000000080000-0x00000000000BC000-memory.dmp family_agenttesla -
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 484 AddInProcess32.exe -
Loads dropped DLL 2 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exepid process 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\GnWfumZ = "C:\\Users\\Admin\\AppData\\Roaming\\GnWfumZ\\GnWfumZ.exe" AddInProcess32.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exedescription pid process target process PID 2992 set thread context of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exeAddInProcess32.exepid process 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe 484 AddInProcess32.exe 484 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe Token: SeDebugPrivilege 484 AddInProcess32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 484 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exedescription pid process target process PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe PID 2992 wrote to memory of 484 2992 6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe AddInProcess32.exe -
outlook_office_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
outlook_win_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\a6a0b8a6-4761-4357-9a31-0eca6ad70093\f.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
memory/484-225-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/484-224-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/484-221-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/484-219-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/484-218-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/2992-42-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-32-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-52-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-64-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-72-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-70-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-68-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-66-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-62-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-60-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-58-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-56-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-54-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-50-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-48-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-46-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-44-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-0-0x000000007419E000-0x000000007419F000-memory.dmpFilesize
4KB
-
memory/2992-40-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-38-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-36-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-34-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-30-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-28-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-24-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-22-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-20-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-18-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-14-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-12-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-11-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-191-0x000000007419E000-0x000000007419F000-memory.dmpFilesize
4KB
-
memory/2992-192-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/2992-194-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/2992-195-0x0000000000700000-0x000000000070C000-memory.dmpFilesize
48KB
-
memory/2992-26-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-16-0x00000000006B0000-0x00000000006D5000-memory.dmpFilesize
148KB
-
memory/2992-10-0x000000006EF40000-0x000000006EFC0000-memory.dmpFilesize
512KB
-
memory/2992-220-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/2992-2-0x00000000006B0000-0x00000000006DC000-memory.dmpFilesize
176KB
-
memory/2992-3-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/2992-1-0x00000000002E0000-0x000000000034A000-memory.dmpFilesize
424KB