Analysis
-
max time kernel
143s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
6629b432266d78f9eb74d2d1a71d0d32
-
SHA1
541816260c71535cfebc743b9e2770a3a601acdf
-
SHA256
831267e0977becf098b5064aac6fd39b5f8e6fd975c06d4b8540cea71d402317
-
SHA512
c8278cca90c8586f4cd3b175e644bd5e35f69f267381338a5eaf92597147d15e7fd2349806d7be46c1279b45864bd06f0329417d1f30fd29b55ab6510d3e290f
-
SSDEEP
6144:RnLhkA6oN8d2uEVtHTgwFOnzLWGG00Ad9Lia9ZJ4s5OBBfGEDG:Rn1NN8YPLzgeOn3rnfdxv92BBnG
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2820 fspptp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Startup = "\"C:\\Windows\\SysWOW64\\objpdb.exe\" h1h" 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\R: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\E: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\Y: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\V: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\M: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\J: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\P: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\X: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\K: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\H: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\T: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\S: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\Q: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\Z: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\G: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\U: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\O: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\N: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\L: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened (read-only) \??\I: 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\fspptp.exe 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\objpdb.exe 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File created C:\Windows\SysWOW64\objpdb.exe 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fspptp.exe 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe Token: SeBackupPrivilege 3024 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2820 2636 taskeng.exe 32 PID 2636 wrote to memory of 2820 2636 taskeng.exe 32 PID 2636 wrote to memory of 2820 2636 taskeng.exe 32 PID 2636 wrote to memory of 2820 2636 taskeng.exe 32 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6629b432266d78f9eb74d2d1a71d0d32_JaffaCakes118.exe"1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:3024
-
C:\Windows\system32\taskeng.exetaskeng.exe {D69514EE-DCE4-4DB2-B3A3-6B0E081A7B60} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\fspptp.exeC:\Windows\SysWOW64\fspptp.exe vwc2⤵
- Executes dropped EXE
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD56629b432266d78f9eb74d2d1a71d0d32
SHA1541816260c71535cfebc743b9e2770a3a601acdf
SHA256831267e0977becf098b5064aac6fd39b5f8e6fd975c06d4b8540cea71d402317
SHA512c8278cca90c8586f4cd3b175e644bd5e35f69f267381338a5eaf92597147d15e7fd2349806d7be46c1279b45864bd06f0329417d1f30fd29b55ab6510d3e290f