Analysis
-
max time kernel
124s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
17-06-2024 02:49
General
-
Target
b670532dbe1f78e7479648c015756837_JaffaCakes118.exe
-
Size
992KB
-
MD5
b670532dbe1f78e7479648c015756837
-
SHA1
631002f475e0bebc74c4896b294eced0d6758946
-
SHA256
6086e45ae6ae2ddfa775d72355d5c9a4c6d9aab84c96412af7d4a1b82ed6f28d
-
SHA512
e1e6acbbc95707d6a6782dbb8bcc70c132ecdeffe6f3e9fd749716e45505193b47bd2f29e56cb514c444c3400a52888f2f05c9a0b0430c7cd5b336c6d7c3b8d1
-
SSDEEP
24576:8NV2pSdrMvP3ApiuTS9ei8jtytauDQBvlZ:vMEfciuRi8MQA8vl
Malware Config
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
?SqRS*vtmraMf
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 32 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b670532dbe1f78e7479648c015756837_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b670532dbe1f78e7479648c015756837_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TdlHBc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB438.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\b670532dbe1f78e7479648c015756837_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b670532dbe1f78e7479648c015756837_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4156,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56467dbc4da3bc59bf4e1fa57d9507051
SHA12c3014ac037e2d8373307c3071a61f9462a94db1
SHA2564633ead20bbf71b800eab9ef81b11bc4db40a813dbcad11e01649d9de939a58a
SHA512ea152df16ac454678b0944424d49b47672e5d49ed22bfbcd4c0e505bde5dff54231afbb1a0be4ec3c3884dacde3de1320e49e64177a93797d90b34c933f4862c
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
272KB
-
Filesize
664KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
7.7MB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
408KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
808KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1016KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
680KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
624KB