Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 10:46
Static task
static1
Behavioral task
behavioral1
Sample
97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe
-
Size
660KB
-
MD5
97ea1072cc7564dca5cd5cdc06f46477
-
SHA1
9fc2ef97d8cbfc3bce5bf761bef1b2bea3559dbf
-
SHA256
830c00fa954d70ef4fb399992385cbc21cd3ccfaf937ecb796c1c736b8a13556
-
SHA512
10c06d9370ea00cc2de10141e1c5a7d50d1ee7451bcac5fece84f3465d2305cc6efc99383a7b4068bcbc7b21c8880a478996193a0e0cba0c5bb55ed08672c454
-
SSDEEP
12288:9crNS33L10QdrXP/X+tGfn/NWQ9nad+hkSpjHqARv+5JkFfwcJaZY81X:ANA3R5drXPrf/B5HzRv+rkCPZF1X
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.wtaxtraction.com - Port:
587 - Username:
[email protected] - Password:
abcdGOODNESS123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe -
AgentTesla payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000015b85-25.dat family_agenttesla -
Executes dropped EXE 2 IoCs
pid Process 2792 avdisble.exe 2460 sample.exe -
Loads dropped DLL 9 IoCs
pid Process 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 sample.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 sample.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 sample.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\cCNVeCBl = "C:\\Users\\Admin\\AppData\\Roaming\\OYwEIOW\\VeBRa.exe" sample.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org 6 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2460 sample.exe 2460 sample.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2460 sample.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2460 sample.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2792 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 28 PID 2904 wrote to memory of 2792 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 28 PID 2904 wrote to memory of 2792 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 28 PID 2904 wrote to memory of 2792 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 28 PID 2792 wrote to memory of 2704 2792 avdisble.exe 30 PID 2792 wrote to memory of 2704 2792 avdisble.exe 30 PID 2792 wrote to memory of 2704 2792 avdisble.exe 30 PID 2792 wrote to memory of 2704 2792 avdisble.exe 30 PID 2704 wrote to memory of 2324 2704 cmd.exe 31 PID 2704 wrote to memory of 2324 2704 cmd.exe 31 PID 2704 wrote to memory of 2324 2704 cmd.exe 31 PID 2704 wrote to memory of 2716 2704 cmd.exe 32 PID 2704 wrote to memory of 2716 2704 cmd.exe 32 PID 2704 wrote to memory of 2716 2704 cmd.exe 32 PID 2704 wrote to memory of 2672 2704 cmd.exe 33 PID 2704 wrote to memory of 2672 2704 cmd.exe 33 PID 2704 wrote to memory of 2672 2704 cmd.exe 33 PID 2704 wrote to memory of 2396 2704 cmd.exe 34 PID 2704 wrote to memory of 2396 2704 cmd.exe 34 PID 2704 wrote to memory of 2396 2704 cmd.exe 34 PID 2704 wrote to memory of 2404 2704 cmd.exe 35 PID 2704 wrote to memory of 2404 2704 cmd.exe 35 PID 2704 wrote to memory of 2404 2704 cmd.exe 35 PID 2704 wrote to memory of 2424 2704 cmd.exe 36 PID 2704 wrote to memory of 2424 2704 cmd.exe 36 PID 2704 wrote to memory of 2424 2704 cmd.exe 36 PID 2704 wrote to memory of 2456 2704 cmd.exe 37 PID 2704 wrote to memory of 2456 2704 cmd.exe 37 PID 2704 wrote to memory of 2456 2704 cmd.exe 37 PID 2704 wrote to memory of 2468 2704 cmd.exe 38 PID 2704 wrote to memory of 2468 2704 cmd.exe 38 PID 2704 wrote to memory of 2468 2704 cmd.exe 38 PID 2704 wrote to memory of 2560 2704 cmd.exe 39 PID 2704 wrote to memory of 2560 2704 cmd.exe 39 PID 2704 wrote to memory of 2560 2704 cmd.exe 39 PID 2704 wrote to memory of 2344 2704 cmd.exe 40 PID 2704 wrote to memory of 2344 2704 cmd.exe 40 PID 2704 wrote to memory of 2344 2704 cmd.exe 40 PID 2704 wrote to memory of 2872 2704 cmd.exe 41 PID 2704 wrote to memory of 2872 2704 cmd.exe 41 PID 2704 wrote to memory of 2872 2704 cmd.exe 41 PID 2704 wrote to memory of 2720 2704 cmd.exe 42 PID 2704 wrote to memory of 2720 2704 cmd.exe 42 PID 2704 wrote to memory of 2720 2704 cmd.exe 42 PID 2904 wrote to memory of 2460 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 44 PID 2904 wrote to memory of 2460 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 44 PID 2904 wrote to memory of 2460 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 44 PID 2904 wrote to memory of 2460 2904 97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe 44 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 sample.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 sample.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\97ea1072cc7564dca5cd5cdc06f46477_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\avdisble.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\avdisble.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1584.tmp\1585.tmp\1586.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\avdisble.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵PID:2324
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵PID:2716
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f4⤵PID:2672
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2396
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2404
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2424
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2456
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2468
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵PID:2560
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f4⤵PID:2344
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵PID:2872
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f4⤵PID:2720
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\sample.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\sample.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2460
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2080
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD549910cb3f37fd8841e0d99a5d4c3a5e3
SHA1da9a68b48304fe8b5ba377bc7ef06a94c649c525
SHA256203995fcd8cd29dfcb929f06676c258a8b35a62719863a6dfec4aa1b0f5a0a90
SHA51203281eb739041cdeffc1eab96c12d3e7d20ade1ab588af3cb7e56c1d7f83ce668290a36553f5f0a3aa119a561d8e5bf4e7ad87549bebc245d28b68c4db8f4ee9
-
Filesize
164KB
MD5dc0dde49b33855c361a46e082b850e00
SHA1c0dcc3bf889ea869ec7297f7be98e952a653bb32
SHA256442e040defcbd0081e2afb4e95f4e147c9cdc720c8d06355efcd96dd267be803
SHA51268f37039752261b1541a3932d9ab769f4471bfaa2eaf945ffe83ed2f3ad24e5efebdb4c70f09e3f2576908401dc3ace804d22481b8ffab73b60f65e1a2d26af0
-
Filesize
90KB
MD56fe5c9b4c64e330be1f56a263fbfa620
SHA1764633b8102846fcbc83850178ec58ece2fa0ed0
SHA256904989b89c9185917059924a585ce9c7f9d18e928bc429c2ea93d058ac73396f
SHA512c2204ee708a7088c7262042d099e3942ea8c453df0c2615ae72d9f2f5b2e871c6f0fdae50459df16e3d5c103449693aac716f4a2a83408771b5c476e2fec65e4
-
Filesize
284KB
MD5b247c1e7766568af825a09eb81c55936
SHA1946d40d213944a4042328f79089f09069f027c99
SHA25614d7bdb0ce532036ac9830842c936d22c4cac6bd3972f7dc52550bda4fd9dd64
SHA5121b469808f863741811d195c55fd30acda1830dc0ffc89c0037bc5b63581391608795b6ed9708361286c65fae40ea31bf71643e2ed3f97aec44661b82ebb7c481