Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 14:47
Static task
static1
Behavioral task
behavioral1
Sample
aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
aa40c4ef4b203519caee4277630754e4
-
SHA1
5c1f63e4c7508c4acbcce75cc774929353fb649d
-
SHA256
ec9281b1e4cbbcb084368da146fd13f55d33aa8b7d8214cadbc0f6b707ef893f
-
SHA512
fa97ca4d10bd262c48a7bdaa3be66f9e3584e3bcedecb57c263edf8bcde5feb73f4a204582044c102adcd88152765b3c97ded6dcabe0283f0cdbe236e30f18a2
-
SSDEEP
24576:iFBrny7d7eqq2Z32fy/VCTK9kM/wAG8qJ5A0Cr:i4kV2h2fMgTK9kMXFqJ5ALr
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2320-31-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral1/memory/2320-34-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral1/memory/2320-33-0x0000000001ED0000-0x0000000001F6A000-memory.dmp family_masslogger behavioral1/memory/2320-32-0x0000000001ED0000-0x0000000001F6A000-memory.dmp family_masslogger behavioral1/memory/2320-29-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral1/memory/2320-57-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wertyytdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation wertyytdf.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe -
Executes dropped EXE 3 IoCs
Processes:
wertyytdf.exewertyytdf.exewertyytdf.exepid process 1940 wertyytdf.exe 2320 wertyytdf.exe 2792 wertyytdf.exe -
Loads dropped DLL 4 IoCs
Processes:
notepad.exewertyytdf.exepid process 2656 notepad.exe 2656 notepad.exe 1940 wertyytdf.exe 1940 wertyytdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2320-23-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/2320-31-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/2320-34-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/2320-29-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral1/memory/2320-28-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
wertyytdf.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook wertyytdf.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook wertyytdf.exe Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wertyytdf.exedescription pid process target process PID 1940 set thread context of 2320 1940 wertyytdf.exe wertyytdf.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\wertyytdf.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
wertyytdf.exepid process 2320 wertyytdf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exewertyytdf.exewertyytdf.exepid process 1108 aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe 1940 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe 2792 wertyytdf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
wertyytdf.exepid process 1940 wertyytdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wertyytdf.exedescription pid process Token: SeDebugPrivilege 2320 wertyytdf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wertyytdf.exepid process 2320 wertyytdf.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exenotepad.exewertyytdf.exedescription pid process target process PID 1108 wrote to memory of 2656 1108 aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe notepad.exe PID 1108 wrote to memory of 2656 1108 aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe notepad.exe PID 1108 wrote to memory of 2656 1108 aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe notepad.exe PID 1108 wrote to memory of 2656 1108 aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe notepad.exe PID 1108 wrote to memory of 2656 1108 aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe notepad.exe PID 1108 wrote to memory of 2656 1108 aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe notepad.exe PID 2656 wrote to memory of 1940 2656 notepad.exe wertyytdf.exe PID 2656 wrote to memory of 1940 2656 notepad.exe wertyytdf.exe PID 2656 wrote to memory of 1940 2656 notepad.exe wertyytdf.exe PID 2656 wrote to memory of 1940 2656 notepad.exe wertyytdf.exe PID 1940 wrote to memory of 2320 1940 wertyytdf.exe wertyytdf.exe PID 1940 wrote to memory of 2320 1940 wertyytdf.exe wertyytdf.exe PID 1940 wrote to memory of 2320 1940 wertyytdf.exe wertyytdf.exe PID 1940 wrote to memory of 2320 1940 wertyytdf.exe wertyytdf.exe PID 1940 wrote to memory of 2792 1940 wertyytdf.exe wertyytdf.exe PID 1940 wrote to memory of 2792 1940 wertyytdf.exe wertyytdf.exe PID 1940 wrote to memory of 2792 1940 wertyytdf.exe wertyytdf.exe PID 1940 wrote to memory of 2792 1940 wertyytdf.exe wertyytdf.exe -
outlook_office_path 1 IoCs
Processes:
wertyytdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe -
outlook_win_path 1 IoCs
Processes:
wertyytdf.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wertyytdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aa40c4ef4b203519caee4277630754e4_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\wertyytdf.exe"C:\Users\Admin\AppData\Roaming\appdata\wertyytdf.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\wertyytdf.exe"C:\Users\Admin\AppData\Roaming\appdata\wertyytdf.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Roaming\appdata\wertyytdf.exe"C:\Users\Admin\AppData\Roaming\appdata\wertyytdf.exe" 2 2320 2593955294⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\appdata\wertyytdf.exeFilesize
1.1MB
MD5aa40c4ef4b203519caee4277630754e4
SHA15c1f63e4c7508c4acbcce75cc774929353fb649d
SHA256ec9281b1e4cbbcb084368da146fd13f55d33aa8b7d8214cadbc0f6b707ef893f
SHA512fa97ca4d10bd262c48a7bdaa3be66f9e3584e3bcedecb57c263edf8bcde5feb73f4a204582044c102adcd88152765b3c97ded6dcabe0283f0cdbe236e30f18a2
-
memory/1108-2-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/1108-1-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/1108-3-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1108-6-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/1108-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1940-18-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1940-26-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/2320-31-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2320-23-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2320-34-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2320-33-0x0000000001ED0000-0x0000000001F6A000-memory.dmpFilesize
616KB
-
memory/2320-32-0x0000000001ED0000-0x0000000001F6A000-memory.dmpFilesize
616KB
-
memory/2320-29-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2320-28-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2320-47-0x0000000002510000-0x0000000002554000-memory.dmpFilesize
272KB
-
memory/2320-49-0x0000000005A30000-0x0000000005A44000-memory.dmpFilesize
80KB
-
memory/2320-57-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/2656-7-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2656-4-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2792-58-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB