Analysis

  • max time kernel
    124s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01-06-2024 06:54

General

  • Target

    89abee532ab6532b360b79e2394ebb4c_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    89abee532ab6532b360b79e2394ebb4c

  • SHA1

    39bfc7dc34e89bef2361b235bfebbe5fa92921e7

  • SHA256

    3cf70f0343ce66c1ac52b00fba64d7f319f7b728aac04705c9db2811551c2ec7

  • SHA512

    5b3b39a0ee41ec8afb1c1998334837b47b32a055694e00d946a011cde32ae6041ea1a5060870579d8f6f473bc525b2849b4833e9e89430caf0a093de5327bf6d

  • SSDEEP

    24576:ubP+DRqZVUTl1111ZN6N6N6N6N6N6N6N6N6N6N6N6N6N:4gIZS1111

Malware Config

Signatures

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89abee532ab6532b360b79e2394ebb4c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\89abee532ab6532b360b79e2394ebb4c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\89abee532ab6532b360b79e2394ebb4c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\89abee532ab6532b360b79e2394ebb4c_JaffaCakes118.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1372-8-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1372-23-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1372-6-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1372-22-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1372-4-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1372-12-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1372-16-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1372-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1372-21-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1372-20-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1372-5-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1372-14-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1372-17-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1372-19-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1608-18-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1608-1-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1608-2-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1608-3-0x0000000074C10000-0x00000000751BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1608-0-0x0000000074C11000-0x0000000074C12000-memory.dmp

    Filesize

    4KB