Analysis
- max time kernel
127s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
10/06/2024, 05:07
General
- Target 9a654c7a4c2e9c89fe8b8cfd6675150c_JaffaCakes118.exe
- Size 1.2MB
- Sample240610-fsaawsdb78
- SHA256 f66895b1e158392dd6bba2e705799955ba7aa21a03bad6d315863fbfac80d804
Malware Config
Signatures
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a654c7a4c2e9c89fe8b8cfd6675150c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9a654c7a4c2e9c89fe8b8cfd6675150c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
aut62F0.tmp
memory/1304-8-0x0000000000400000-0x0000000000438000-memory.dmp
memory/1304-9-0x0000000074DD2000-0x0000000074DD3000-memory.dmp
memory/1304-10-0x0000000074DD0000-0x0000000075381000-memory.dmp
memory/1304-11-0x0000000074DD0000-0x0000000075381000-memory.dmp
memory/1304-12-0x0000000074DD0000-0x0000000075381000-memory.dmp
memory/1304-13-0x0000000074DD0000-0x0000000075381000-memory.dmp
memory/1304-14-0x0000000074DD2000-0x0000000074DD3000-memory.dmp
memory/1304-15-0x0000000074DD0000-0x0000000075381000-memory.dmp
memory/1304-16-0x0000000074DD0000-0x0000000075381000-memory.dmp
memory/1304-17-0x0000000074DD0000-0x0000000075381000-memory.dmp
memory/1304-19-0x0000000074DD0000-0x0000000075381000-memory.dmp