Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 00:40
Static task
static1
Behavioral task
behavioral1
Sample
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe
-
Size
992KB
-
MD5
73c81dd67773b2efa5261e20adf74a5b
-
SHA1
fde0db688d6abb4aad0bb646db9f1c192d980b5a
-
SHA256
ad32cadc3a75e969c0e8c25dfec398378aceb406017050763ce3c5d482998f42
-
SHA512
8b2483b0dedf9d6b9329202d40544291b55601518c3b14f5df764e277114ee6538bdf6d08efcb8c3dad99ac7368471354acb1bf1ecd3f7da2c072f8c5a8e24d9
-
SSDEEP
24576:8I3j32qQLhX/CUoDnbUVo2yhVx/NOMCh/zduiMxVRPXQJA:j6DhaJAMx/NOMChxp8PXg
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2220-13-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/2220-19-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/2220-22-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/2220-17-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger behavioral1/memory/2220-14-0x0000000000400000-0x00000000004B8000-memory.dmp family_masslogger -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 1948 powershell.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exedescription pid process target process PID 2200 set thread context of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exepowershell.exepid process 2220 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 2220 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 1948 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exepowershell.exedescription pid process Token: SeDebugPrivilege 2220 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe Token: SeDebugPrivilege 1948 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.execmd.exedescription pid process target process PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2200 wrote to memory of 2220 2200 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe PID 2220 wrote to memory of 2256 2220 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe cmd.exe PID 2220 wrote to memory of 2256 2220 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe cmd.exe PID 2220 wrote to memory of 2256 2220 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe cmd.exe PID 2220 wrote to memory of 2256 2220 73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe cmd.exe PID 2256 wrote to memory of 1948 2256 cmd.exe powershell.exe PID 2256 wrote to memory of 1948 2256 cmd.exe powershell.exe PID 2256 wrote to memory of 1948 2256 cmd.exe powershell.exe PID 2256 wrote to memory of 1948 2256 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\73c81dd67773b2efa5261e20adf74a5b_JaffaCakes118.exe'4⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2200-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmpFilesize
4KB
-
memory/2200-1-0x0000000001130000-0x000000000122E000-memory.dmpFilesize
1016KB
-
memory/2200-2-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2200-3-0x00000000004A0000-0x00000000004B8000-memory.dmpFilesize
96KB
-
memory/2200-4-0x0000000074BDE000-0x0000000074BDF000-memory.dmpFilesize
4KB
-
memory/2200-5-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2200-6-0x0000000005790000-0x000000000585A000-memory.dmpFilesize
808KB
-
memory/2200-7-0x0000000000740000-0x0000000000746000-memory.dmpFilesize
24KB
-
memory/2200-8-0x0000000004E00000-0x0000000004EBC000-memory.dmpFilesize
752KB
-
memory/2200-26-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2220-11-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2220-13-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2220-19-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2220-22-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2220-24-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2220-23-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2220-17-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2220-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2220-14-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2220-25-0x0000000001060000-0x00000000010D8000-memory.dmpFilesize
480KB
-
memory/2220-9-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2220-27-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB