Analysis
-
max time kernel
129s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 02:41
Static task
static1
Behavioral task
behavioral1
Sample
6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
6d15881beb1e1e6f550c3c461f3abf4f
-
SHA1
bc3d19be6be897122245d372deb17e2c7683d7e4
-
SHA256
c8792bf91afadb45be4732aa53a644e1aa01cc64a6c59e1fa84a05ed4f26e9ef
-
SHA512
a27eb28a7df64690134ca96bf775ad404437bc4b4e50be7e6f0cef6cc8441e160e880c64d47828e423d7389b710b57762d8ccde70d4f2fc3cf489eeca2347c2f
-
SSDEEP
6144:GzuidtRNEzCjP4tj1LamdiGT1jszJssN+qZRFVkLFKB8BW8/LRFnyJN7sL4agU0J:UtRKuTccVkjsz7NlVkLmSDy8s8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gandi.net - Port:
587 - Username:
[email protected] - Password:
Blessed000@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/6080-20-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
appx.exepid process 5676 appx.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
appx.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\appx = "C:\\Users\\Admin\\AppData\\Roaming\\appx.exe" appx.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
appx.exedescription pid process target process PID 5676 set thread context of 6080 5676 appx.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
InstallUtil.exepid process 6080 InstallUtil.exe 6080 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exeappx.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3408 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe Token: SeDebugPrivilege 5676 appx.exe Token: SeDebugPrivilege 6080 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 6080 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.execmd.exeappx.exedescription pid process target process PID 3408 wrote to memory of 2016 3408 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe cmd.exe PID 3408 wrote to memory of 2016 3408 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe cmd.exe PID 3408 wrote to memory of 2016 3408 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe cmd.exe PID 3408 wrote to memory of 452 3408 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe cmd.exe PID 3408 wrote to memory of 452 3408 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe cmd.exe PID 3408 wrote to memory of 452 3408 6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe cmd.exe PID 452 wrote to memory of 5676 452 cmd.exe appx.exe PID 452 wrote to memory of 5676 452 cmd.exe appx.exe PID 452 wrote to memory of 5676 452 cmd.exe appx.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe PID 5676 wrote to memory of 6080 5676 appx.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\6d15881beb1e1e6f550c3c461f3abf4f_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\appx.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\appx.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appx.exe"C:\Users\Admin\AppData\Roaming\appx.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appx.exeFilesize
1.4MB
MD56d15881beb1e1e6f550c3c461f3abf4f
SHA1bc3d19be6be897122245d372deb17e2c7683d7e4
SHA256c8792bf91afadb45be4732aa53a644e1aa01cc64a6c59e1fa84a05ed4f26e9ef
SHA512a27eb28a7df64690134ca96bf775ad404437bc4b4e50be7e6f0cef6cc8441e160e880c64d47828e423d7389b710b57762d8ccde70d4f2fc3cf489eeca2347c2f
-
memory/3408-8-0x000000007486E000-0x000000007486F000-memory.dmpFilesize
4KB
-
memory/3408-3-0x0000000004E80000-0x0000000004F12000-memory.dmpFilesize
584KB
-
memory/3408-1-0x0000000000300000-0x0000000000476000-memory.dmpFilesize
1.5MB
-
memory/3408-12-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/3408-5-0x0000000005500000-0x0000000005AA4000-memory.dmpFilesize
5.6MB
-
memory/3408-6-0x0000000004E30000-0x0000000004E74000-memory.dmpFilesize
272KB
-
memory/3408-7-0x0000000005AB0000-0x0000000005B16000-memory.dmpFilesize
408KB
-
memory/3408-0-0x000000007486E000-0x000000007486F000-memory.dmpFilesize
4KB
-
memory/3408-4-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/3408-2-0x0000000000CE0000-0x0000000000CF2000-memory.dmpFilesize
72KB
-
memory/5676-17-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/5676-18-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/5676-19-0x0000000007B40000-0x0000000007BDC000-memory.dmpFilesize
624KB
-
memory/5676-22-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/5676-16-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/6080-24-0x0000000006A60000-0x0000000006A6A000-memory.dmpFilesize
40KB
-
memory/6080-20-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/6080-23-0x0000000005590000-0x00000000055A8000-memory.dmpFilesize
96KB