Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 06:58
General
- Target a45093c46a998137b18e4ec60a7341da_JaffaCakes118.ps1
- Size 2.5MB
- Sample240613-hrqycssdrr
- SHA256 a3b029d42bd7d807c09240ae9002750c41f0e7e840ac97e7c069d3123510f098
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
- AgentTesla payload 12 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a45093c46a998137b18e4ec60a7341da_JaffaCakes118.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vjcg.exe"C:\Users\Public\vjcg.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NANO no startup.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NANO no startup.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hht3mlqg.buk.ps1
NANO no startup.exe
vjcg.exe
memory/2448-23-0x0000000003500000-0x0000000003501000-memory.dmp
memory/4552-49-0x0000000005200000-0x0000000005292000-memory.dmp
memory/4552-37-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-66-0x0000000073790000-0x0000000073F40000-memory.dmp
memory/4552-65-0x000000007379E000-0x000000007379F000-memory.dmp
memory/4552-24-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-29-0x000000007379E000-0x000000007379F000-memory.dmp
memory/4552-41-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-44-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-46-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-43-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-47-0x00000000050C0000-0x000000000515C000-memory.dmp
memory/4552-48-0x0000000005710000-0x0000000005CB4000-memory.dmp
memory/4552-64-0x0000000006A50000-0x0000000006A5A000-memory.dmp
memory/4552-38-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-50-0x0000000005CC0000-0x0000000005CD8000-memory.dmp
memory/4552-62-0x0000000006AD0000-0x0000000006B20000-memory.dmp
memory/4552-51-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/4552-35-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-33-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-31-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-30-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-32-0x0000000000800000-0x0000000000890000-memory.dmp
memory/4552-52-0x0000000073790000-0x0000000073F40000-memory.dmp
memory/4552-61-0x0000000006710000-0x000000000671A000-memory.dmp
memory/4792-1-0x0000025772F10000-0x0000025772F32000-memory.dmp
memory/4792-12-0x00007FFFA8220000-0x00007FFFA8CE1000-memory.dmp
memory/4792-0-0x00007FFFA8223000-0x00007FFFA8225000-memory.dmp
memory/4792-11-0x00007FFFA8220000-0x00007FFFA8CE1000-memory.dmp
memory/4792-19-0x00007FFFA8220000-0x00007FFFA8CE1000-memory.dmp