Analysis

  • max time kernel
    92s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 05:51

General

  • Target

    ad10830a3342900f70cac19a8d1b6abe_JaffaCakes118.exe

  • Size

    996KB

  • MD5

    ad10830a3342900f70cac19a8d1b6abe

  • SHA1

    205261ebec6b48d1eda0ff543198fa23a62490a1

  • SHA256

    1648342127afbaed5c1eab686168efe8d174f0a8115f2357b67ca1da021f3270

  • SHA512

    297c715bf5197a44188a7041ec879e7e4ee91a0fba895fa1057d1af102221bda0b06a4a95b26370d549c90bc1ddbeb16d45eaeb7aa514de2bf0771d5a8ac2d3a

  • SSDEEP

    12288:HrGuxcx90nsc2x4d6Z7Zw4ySVz0Mw4kdKH7JW/heXGb18EYMtxGDunB8aebR:HrG2CR4N4PwMw4r7VQ6zMtImyL

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kuatuvxpqfxoxbth

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad10830a3342900f70cac19a8d1b6abe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ad10830a3342900f70cac19a8d1b6abe_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\ProgramData\TFjXAla\PgYcv.exe
      "C:\ProgramData\TFjXAla\PgYcv.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp5DFE.tmp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4896
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp60BE.tmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        • Suspicious use of AdjustPrivilegeToken
        PID:3928
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp612D.tmp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\TFjXAla\PgYcv.exe

    Filesize

    996KB

    MD5

    ad10830a3342900f70cac19a8d1b6abe

    SHA1

    205261ebec6b48d1eda0ff543198fa23a62490a1

    SHA256

    1648342127afbaed5c1eab686168efe8d174f0a8115f2357b67ca1da021f3270

    SHA512

    297c715bf5197a44188a7041ec879e7e4ee91a0fba895fa1057d1af102221bda0b06a4a95b26370d549c90bc1ddbeb16d45eaeb7aa514de2bf0771d5a8ac2d3a

  • C:\ProgramData\bsNiLXEzb\044a2df5102748ddacb7881a228226dd

    Filesize

    8B

    MD5

    e83b7ff967e2529f3e452cdd72fc10f2

    SHA1

    d5667e6c3cf485214ecbaf200ffa74a1424510ae

    SHA256

    8eacf57cf79c2722e9332977919fc4c5b6f36eae964e4282ee760d9651db3d9e

    SHA512

    ceb49abb4c1647ceed6a59622b973cd0a5127c61ef3afb3f7ec7bfcf7165d6f7f4a322924401965d3b50d65ee1764eb68aa28697d2746ea3eb10e0a0996eada6

  • C:\ProgramData\bsNiLXEzb\fb165896bb11473eadc2346276cfaa55

    Filesize

    16B

    MD5

    578716a8b6b660ba05159a4957ac238d

    SHA1

    1745319c341f18093ca1aaf93f15d80fc8a65524

    SHA256

    2f38824c68ecbe5a889bd00b4165f467cd94ea6f4da5356db76fa3724b5d16fe

    SHA512

    bac6582e7db0e6a0c31a1374a7abf36a65a62d360c082ed634d6be73632c966c10a06d46829e1ad79fe040934beea65b68d51c06a09d9569dd99f83b77e0fc70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404

    Filesize

    81KB

    MD5

    cd800dd610d5f7266075e862ae13b920

    SHA1

    616db329b91e7a7fe4c78f10a6f1bd6c1e07dd8a

    SHA256

    8ec5be304f8d66f4842f193ca4e3738dffe28d3efe55eea69db834a6588fb019

    SHA512

    962b90722a9ef2b48e84c40e62bee89978dec927a9ea70fa4e5d8597e33b4508d7f906740cddc8eeea4372c4ba365a2a26bcb038005468d885772205d140419c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

    Filesize

    1KB

    MD5

    46804d944f11e97d7623dd5cd0c3c3fe

    SHA1

    be0708b276871a160404529f8b69d487f04f026f

    SHA256

    9c5e42911b86a54279cc962def8e3284d1095d321d43a75e6e2dbab9669a10b0

    SHA512

    1b9e8eb59ab434cd97db2b99b7d92f42d2b7e29dcc10d2c23c9f87445d26d94817cc4cabca7f6be1882fb383c4085494827a937e0ea1d95733cf5d3ba3a14c02

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_0F96BACF3D5FC89AB4994155F45ADF7B

    Filesize

    509B

    MD5

    ebf8b5bf1e25ca35ef1dc8cc25307f7e

    SHA1

    d5ca1658dcc9996c2e74e62c1ce88738381fbee1

    SHA256

    c6c513d636bea7006389e76d380c0f0fa3874fa4bc5436578357a076de309246

    SHA512

    58d002388e21138f953af86c6fff41e5ffd8e926b6884f49b372cf6123cd6f5970d1719e50cca488576bde41bf9fb41f2a5ed90223ae5abf777f9a153ca01c37

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404

    Filesize

    300B

    MD5

    0b9187e593e686044a610abfe96c25b7

    SHA1

    8534bdb1e02a61e8c30134c9e123da2ab9c8bdc7

    SHA256

    54cfd7010055af3f9d7f159cc4e6743aae214cb1730fc11745f9a5ff52670d23

    SHA512

    e341a74c256cbf474a72f1e07f07899acb16da1920783f25d33893192eaa16a57221b6706466b2a7dcf0ef16feb5a3ec4d8229ea3e319ccfb53896b53fa13478

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

    Filesize

    398B

    MD5

    86588fffc7a0af9f576fbffc655192ab

    SHA1

    4169e1435e462de160936a4d20b7356fa69b2bf6

    SHA256

    75c2c070a14efda171db2c819954e25b02e0037c689fabff65073ca24cebaa22

    SHA512

    3f97687237e1f8bc762c9098bedc9124eda56edd83d530970bde420ee06a2bd71352b423f64ef042fc9b38112191e2ea9134697c031ca1e79f64603a78789b2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

    Filesize

    500B

    MD5

    b97e64a86c999ec479a9a2b11eda10ea

    SHA1

    948005adf5d78c37af413d31bb125132b06ef189

    SHA256

    2badb7ed2925ce5a1eee5b258ceb3950a9631b43643738867d938d2033f55863

    SHA512

    06a39096adbb1700fcc4279b0e8236e7ccc013985ce21d3681ffeae0a46b9cf9437fa1a4540e49dbe9ce804594e3ac121b70957248dd893ca690481f40f4dbed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_0F96BACF3D5FC89AB4994155F45ADF7B

    Filesize

    490B

    MD5

    a0f7376e1f79ecdae22e6056d3d35d21

    SHA1

    5bc80480b5014bd2739eba15f4df3fac62749af4

    SHA256

    6e029f4314dfd8b27d48008f0579f978b9c7c50600921b26b57901526a28d652

    SHA512

    780fcced1a99d476f9ba7e91d81faae0f2374cf478dc8df3054ef3a570e46956b154aafbb3b279f9af971ebbe31451dd0d09546b5876e4714c7546f2a8a874c4

  • C:\Users\Admin\AppData\Local\Temp\tmp5DFE.tmp

    Filesize

    1KB

    MD5

    b0cc2e6f2d8036c9b5fef218736fa9c9

    SHA1

    64fd3017625979c95ba09d7cbea201010a82f73f

    SHA256

    997aceeb78143e057d4ea0ed699db3cc1c723f699b4532663b7b85c83baa5c50

    SHA512

    a1fe80b2971c4d1141a594f27eaea61500bf701cd1b8fbdb5ac2204a63c8ef862344f8c30f65ce769f0acf2b0718ed33a02744dd1a152c4a62a5318333d29b9b

  • C:\Users\Admin\AppData\Local\Temp\tmp60BE.tmp

    Filesize

    400B

    MD5

    de4e5ff058882957cf8a3b5f839a031f

    SHA1

    0b3d8279120fb5fa27efbd9eee89695aa040fc24

    SHA256

    ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49

    SHA512

    a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72

  • C:\Users\Admin\AppData\Local\Temp\tmp612D.tmp

    Filesize

    391B

    MD5

    3525ea58bba48993ea0d01b65ea71381

    SHA1

    1b917678fdd969e5ee5916e5899e7c75a979cf4d

    SHA256

    681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2

    SHA512

    5aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986

  • memory/436-94-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/436-95-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/436-97-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1164-48-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/1164-104-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/1164-72-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/1164-103-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/1164-102-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/1164-101-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/1164-66-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/1164-47-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/3928-90-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/3928-86-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/3928-88-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/3928-87-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/4012-2-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4012-0-0x0000000075142000-0x0000000075143000-memory.dmp

    Filesize

    4KB

  • memory/4012-44-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4012-29-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4012-1-0x0000000075140000-0x00000000756F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4896-83-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4896-79-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4896-75-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4896-74-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4896-71-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB