Analysis
-
max time kernel
146s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
03/06/2024, 05:59
General
-
Target
90c1ca96660786fb2a12b5b07d4c8fd9_JaffaCakes118.exe
-
Size
3.6MB
-
MD5
90c1ca96660786fb2a12b5b07d4c8fd9
-
SHA1
e692ce97978666380886bb089358238100be84bb
-
SHA256
3d966ba83a832ae1c76ff14716925e6895777001064d42404fb86494571309ce
-
SHA512
84d3fdc8b8d3385bf3b271c44d3d97c262f5157ea9cdafd6803b5060040d32b3d0c8ab2868ca83161035813e55061cc13c598fc18ae831088a7ace23abaf86c8
-
SSDEEP
98304:lAfX4VspnQIzlUicRp7bWNrgTFZKVVjvvvisLf2IQzRRs:lAIRollcfbWNrkZKHt5Q9a
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 9 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 16 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 41 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90c1ca96660786fb2a12b5b07d4c8fd9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90c1ca96660786fb2a12b5b07d4c8fd9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-R5QBO.tmp\90c1ca96660786fb2a12b5b07d4c8fd9_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-R5QBO.tmp\90c1ca96660786fb2a12b5b07d4c8fd9_JaffaCakes118.tmp" /SL5="$90030,3400720,135680,C:\Users\Admin\AppData\Local\Temp\90c1ca96660786fb2a12b5b07d4c8fd9_JaffaCakes118.exe" /verysilent /password=none2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AbodeUpdate\SkypeC0SvcService.exe"C:\Users\Admin\AppData\Roaming\AbodeUpdate\SkypeC0SvcService.exe"3⤵
- Sets DLL path for service in the registry
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AbodeUpdate\svpn.exeC:\Users\Admin\AppData\Roaming\AbodeUpdate\svpn.exe install C:\Users\Admin\AppData\Roaming\AbodeUpdate\TeamViewerVPN.inf teamviewervpn4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\AbodeUpdate\svpn.exeC:\Users\Admin\AppData\Roaming\AbodeUpdate\svpn.exe restart teamviewervpn4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k MsHubSvc -svcr C:\Users\Admin\AppData\Roaming\AbodeUpdate\SkypeC0SvcService.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{47e8e878-4cc8-304f-be08-8b37cf2bb6e9}\teamviewervpn.inf" "9" "4b0706d3f" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "c:\users\admin\appdata\roaming\abodeupdate"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:teamviewervpn.ndi:2.10.0.0:teamviewervpn," "4b0706d3f" "0000000000000160"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
1.1MB
MD586c17be77f3ea314eb1c43fb46ec2ee9
SHA157e664459585cb739e1ee278ff62ac25bd0fe0c0
SHA25667668d64d65f1f39d37f9f02643ef07e0f1da8599a48796967a9ebbbcee9efa2
SHA512320c17430584ee127c50ba3d8618dde649f97abea550f3f213a6637d48ffd21ce83103ed34c9ac2e5eb769b839293ddcb6e465d16a8ff876bae3a8bd58b2d787
-
Filesize
135KB
MD57be8e8b6eb0a7b3e4d02bd1e1c0694d3
SHA1e8eab9de90873e267d63636fd269561ea7fb6d77
SHA256e89d182578568985c7524f1a0c221a1b46b515ac3036de356f5066d9f7a41b90
SHA512ed08a7ba3cbd974898577ed9ca9a6eab90dfdd124d0b2321a5e02ed40c3e47c2bd57f2c132ed7cb5b55e8f5b7036e7fa733dbb4049226a8dc4ec5d1154bb9cd4
-
Filesize
7.7MB
MD5f5fe906f801d99fafa8a9e0584a37008
SHA1a80175b91e3f9606e63dd0d9a9271e23bbe10321
SHA25610b12825603dc3f1946bfd4e7cbebda5885fe4fccaeb0df8b6e862ad3dad720b
SHA512ae149680b212cf0b7f11d841cede275d8e510d3af86c96d75ff75802a8543773a5b7fc9d4c84d4d5fa486d2ddf27129cc42e70d0ea34ca2624f14152ba7497de
-
Filesize
152B
MD58fc2e199aa5721f837d2ce2766a5860d
SHA13a09dfa5e28a2044cd99388bf1265927c1444a94
SHA256044f6e06ced9cdaff36795408e5e3046b290367bc88f0708b2b5bd1b91bfbad5
SHA512a8ca2f66f7b8cfb7ff67cfcec35848c7c2f29bc8b26d1239622a61a779b67d7af829699207f18dab8c9294dd9226943dac47ef8aeedfd90dfb733c13f1f218b5
-
Filesize
5KB
MD5447fc733747db11cd4492ae01c5652fe
SHA12a70dcd391464cb8d3736322e07e966e105d396e
SHA256a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3
SHA512238099db072af55445d421e941944abe8a6f52a124a26cae84c1dd52fffafc4dac5586d0c7407b461cd0db8e771e1dbb6ca34aee84581b24347f401410b2afe5
-
Filesize
2.2MB
MD536738935b6eadbdf570002ee44990360
SHA12621f86a0307a6be7032266db868c7af981bc016
SHA25646aa5507bf0866d924a7974e7dc9255db21efb8ba5dc15e3c1a19c5b408ad29c
SHA5125737edd344008832b1925972913cb2ba49d1e177a331a5419c5f6cb966f7da735fff1722acf59d5514cf63c2834a5f49d9784b70996fb0186cbbab6de3835f14
-
Filesize
285KB
MD55850b0e30cb6493170ea8d073f34766c
SHA1d80b0181edca5be738f8c1c4355c4785d0360d06
SHA25697f8b0f6307156c0c74f3309195c376e5d816b3dbd65048c241a8b7e9233eeda
SHA512a1a8ee334ef763a78214fbc6a915e9adbf0cdbafb6694fac6e70cb68f2aacfcad945c7b4629bf3b729e8b9b3fcd7956c04a63c89fb6bda7111f41f9c8cb96144
-
Filesize
2.5MB
MD54202e46ac536822fd7043c38e66d0ec8
SHA1c8908477b539931168e9437d4e17e7c33fb10141
SHA256542075ba11aaa6c1961985818dc4bb9e1a13afffeaef3514389444db18938fb4
SHA51220210b8dd54b7ca527e69699ae02d6b1c1733e8e3c8ae797994d24b2134e91d4dbc8345b9a4757ded6a34f460d9ec88b1c133202718e342c9045c77de2bd784d
-
Filesize
79KB
MD5112b0c8b6b0c0a6c24f90081cc8a77d0
SHA11776a73316baeeb818884196a54f49d1385c06c8
SHA256f627380e9de14af3eb5331bb9a4d559b2c970abacff038ea464044ca1ef62163
SHA5121552b267931004d8936058f5cac49dc618eae2224ea3b082f1d899cd1b2c1cb7eaa98ac7653740fd07b2df40abbdd2d6318a9bed8794bb7a8872e379a50ef585
-
Filesize
66KB
MD555b4875e6dd84b1a547a91a789515dfb
SHA1ad598670ced636134f85c744f6283a16e3766d1f
SHA256a0791b2f732fdd0c26483d9ef2d77e720d9ba267f887eccadff227bcf247a0a9
SHA512d9dc737c25a56503bba8f3a2fa030c3dc1fe62f4313cb307203cdcac164fd6bb2fa2ab87be6806d4cf3d1ed1ec880a1c7f3d866e61c3a6005ca400ff9f99459a
-
Filesize
104KB
MD5c16719e5c670b7c18aab69dea8ea8c66
SHA195c9c3b44dcca278b42cb20b1e27d88ae4006f39
SHA256c23d33f637c3c90ce0e3fc366fce034c5592dd80b660f469619e38b255532689
SHA5129bae42f6e6ace1e1f0d923894399817a017a1e52e2b01bb780d2a7be20f82ac341b1c9f6de680f16a0b8d5532c0f77f495dde2ad0c95ff85118021785dcd3b3b
-
Filesize
80KB
MD56f68147027ba59a8af86ffe1b8fc6899
SHA199bb32e1d752a2b93bcd9db36b8a4f3c01ba6458
SHA25607413a73f7566173b462d7a4de2ca74d211f0872682160afafa618e656cfe9e6
SHA5125011e05ebcf6e86a988ba79e3f0aec2f240b14c5a602260edc53fa1c4b11c23495171213fe30ab8bf53f9e0c15e6dffa6a463105d1d558a3def50fdc28e571d2
-
Filesize
126KB
MD58e50a67752bd070fec717216b9376a7f
SHA119c776fd0fe89d6cb3f372d89cac4adf65dabe24
SHA256f7b239c4101db7c974eef31ba2dd42fba0e898cfa762b1e969f76a7a37aa3d8b
SHA512be16f2fc675d1231275fd618ea101bfafa71c31b2cea92c5fb1197384bd0ea764e4567350bc1309d9d83439a977ed7600c57c4f5be81bf7170b2d5e59fe1ef46
-
Filesize
351B
MD5c355c34a3f8e355aa20eaaaa9bbdffe5
SHA13b13ae21d7cdbe427a9367761b590bfb3a1e04c0
SHA2565fca1c7124684f5c3a8a2ce9caab53da751c76d0db8b538cc0b812d7f8dda110
SHA512b665b65c1023b5f9f255388963245f0efa913d5b89024fa2eb03d164eb63d5334addf1a67b9db1a6ad8ef685c3d614d87225db1ec59b9c99459bc5f0b81d29ad
-
Filesize
54KB
MD5d4fe3ae6d05b2d4cb52484e2718ab390
SHA18da95d697c578c8d12e02c53fb185cb5825c4f63
SHA2560fc7396c9eb14f764b18400f95c66fd168ec0626d455b48167119227b3b98c1e
SHA51203a253bbc1663b7c03632c4a265195e2d668da5a0b3c6144ed2006fdffe50e131bb2a589aa41304e20979fa9a27e2acdbe8860916219d8ee265ebc185ef60fdd
-
Filesize
42KB
MD5c7549d78f082a6cf81ba2c27f6c6a38f
SHA1ea39fbc80cc62c11ace1ef495c856f3bc6c775a7
SHA256240b9ee414817f500c18bffaba787c6f7b5e67a0e46d82cbbce02cb956073be3
SHA512ffa75d64446b227642af964c6d5a8e1a14493b56d598b52cbd842cf22a9396eddde716effc431d25b21a26741bdaf9e2b509821099a5eb3e01bfc2343816fc2f
-
Filesize
34KB
MD5f5520dbb47c60ee83024b38720abda24
SHA1bc355c14a2b22712b91ff43cd4e046489a91cae5
SHA256b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0
SHA5123c5bb212467d932f5eaa17a2346ef8f401a49760c9c6c89c6318a1313fcbabb1d43b1054692c01738ea6a3648cc57e06845b81becb3069f478d5b1a7cbcb0e66
-
Filesize
10KB
MD55cffe65f36b60bc151486c90382f1627
SHA1f2a66eae89b4b19d4cab2ac630536af5eeeef121
SHA256aa7c09a817eb54e3cc5c342454608364a679e231824f83ba5a2d0278edcc1851
SHA5121bd48ef66f8714e7e9591043d03bd69a30881ed3d0f2463b15750a3282df667ffb076b3a92358eecedae0e54485b07d702667e8fe0af64c52be04db47145920b
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
68KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
152KB
-
Filesize
960KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
152KB
-
Filesize
960KB