Analysis
- max time kernel
140s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
17/07/2024, 06:05
General
- Target 51bf91997f8dd9a6cb1abd28e7ad8e54_JaffaCakes118.exe
- Size 582KB
- Sample240717-gs9les1eph
- SHA256 ea52bbd42da9e0a38915bf663dee48a58add23f62617f0178ea4906218936fa6
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendMessage?chat_id=1637651323
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51bf91997f8dd9a6cb1abd28e7ad8e54_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\51bf91997f8dd9a6cb1abd28e7ad8e54_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XEZKlxP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2E7D.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\51bf91997f8dd9a6cb1abd28e7ad8e54_JaffaCakes118.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 17883⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1452 -ip 14521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
51bf91997f8dd9a6cb1abd28e7ad8e54_JaffaCakes118.exe.log
tmp2E7D.tmp
memory/1452-21-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1452-20-0x0000000006E60000-0x0000000007022000-memory.dmp
memory/1452-19-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1452-18-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1452-14-0x0000000000400000-0x0000000000468000-memory.dmp
memory/5052-4-0x0000000004AA0000-0x0000000004AAA000-memory.dmp
memory/5052-8-0x000000007529E000-0x000000007529F000-memory.dmp
memory/5052-9-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/5052-10-0x00000000076D0000-0x0000000007794000-memory.dmp
memory/5052-7-0x0000000005E10000-0x0000000005E22000-memory.dmp
memory/5052-6-0x0000000005E30000-0x0000000005ECC000-memory.dmp
memory/5052-5-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/5052-17-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/5052-0-0x000000007529E000-0x000000007529F000-memory.dmp
memory/5052-3-0x0000000004AB0000-0x0000000004B42000-memory.dmp
memory/5052-2-0x0000000004FC0000-0x0000000005564000-memory.dmp
memory/5052-1-0x0000000000010000-0x00000000000A8000-memory.dmp