Overview

overview

10

Static

static

1

79d1c8d13e...18.msi

windows7-x64

10

79d1c8d13e...18.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-05-2024 16:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79d1c8d13e8bb5c694d07e6471f9db57_JaffaCakes118.msi

  • Size

    512KB

  • MD5

    79d1c8d13e8bb5c694d07e6471f9db57

  • SHA1

    231677689b7e2f0b1aa0cfdd190d47462a5279b9

  • SHA256

    deb9ffc5dbe5a8b0beb10318f8cfa635ed58507056908e017e82dfda950bf3f9

  • SHA512

    808240029755b182c9491668ff177e606f7d7a513f2cc535397816c847808e738aa0a8e4be57f2166293c8795756a81300c9c40d869ffb5eff2c2e8e9db0363b

  • SSDEEP

    6144:MEja+qQBv6voU7lpBJjPK22eC+Ic6LRWwp9porgB1O2/BCxBE4+/u4x/HLUWy4+d:MEjmQB6lpJ2eC6wu2yE4yZx/HwrK4

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://31.220.2.200/~justicet/ag/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\79d1c8d13e8bb5c694d07e6471f9db57_JaffaCakes118.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4136
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:224
    • C:\Windows\Installer\MSI9154.tmp
      "C:\Windows\Installer\MSI9154.tmp"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:2904
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\0f5007522459c86e95ffcc62f32308f1_310807ab-751f-4d81-ae09-b202eaf21e19
    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    Download Submit

  • C:\Windows\Installer\MSI9154.tmp
    Filesize

    488KB

    MD5

    7d2156aa23eb3331e0725fbaac058002

    SHA1

    bc3154764a7685baaa3e466856fdab1ae50d179f

    SHA256

    dac334eeaeaecc4072797f8e65085cf8b8c519462d0dd3d4c4856a1631ee87e7

    SHA512

    e1ab75a2ed81d02727517c0deaaf945ab25decd855f8b567ac05f83af27fc6014d2d43d1e0a4a97e186226c300a48e98ec58bc88d05e53a87214cecd819ac029

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.7MB

    MD5

    420271892069ede402ae3d797bc5148a

    SHA1

    22c1e8e7fae647dd3643df53abbab003a78a5c98

    SHA256

    724caa5aae2e6c95527967064dcf71f8fad2466e2ab5d17751a75668840f6df5

    SHA512

    e442ddf53f24b0f707a52057d6d55f41274abbf58167e57be3271f91f05969300729a3c43a84646803f29367ff4c7453b67200bb01eec6bcd3397fff13b11e1a

    Download Submit

  • \??\Volume{8ccc3c3f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{682e254a-24ec-4a72-993b-6dc35bee88cc}_OnDiskSnapshotProp
    Filesize

    6KB

    MD5

    e430bb23dc1d71dd5431f69668a65d25

    SHA1

    268f93f3276508dda090ff7d46d91d9f0d3fc7ca

    SHA256

    ccde32eff47b7f85d464ae693c66779bda1a770352d8a2fe7eb03b223a092741

    SHA512

    13b024f712001b8d8d7ee0482564489a1ea23eaf44354c4d7335e61bfe8ae3e70e46b2721cc6e6f9ef2d9bd9ab98184d174007e9bb92fcda89971b1956137f18

    Download Submit

  • memory/2904-18-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

    Download

  • memory/2904-38-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

    Download

  • memory/2904-50-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

    Download