Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 23:57
Static task
static1
Behavioral task
behavioral1
Sample
a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe
-
Size
4.0MB
-
MD5
a8c0796d74fe9e34fe0c67a500dc7b32
-
SHA1
ebdd34cd4fda39ade14e4fc0c4e8ce4b397e8959
-
SHA256
0ff222e570a6934c471b2bcb13b78f88c75e95141b7c84bbd3dc936d7d46437b
-
SHA512
906db571ec138e9fec43e9182ecf2a6a2af7120f85169e14e68d4632c36bf785768a87e2043c9107b0db23f0a3f7c7473b8b1a45a943b79d68d9baf2d8bede33
-
SSDEEP
98304:acC8excbiUsPc9K7YrHDjJzp1PGcjXF1D4TQ4Ll5nZGv13dwsBD:acC8eKGU8c9fVpBLJ1MT5J5nZp
Malware Config
Extracted
danabot
1765
3
79.124.78.236:443
134.119.186.199:443
192.236.162.42:443
134.119.186.198:443
-
embedded_hash
82C66843DE542BC5CB88F713DE39B52B
-
type
main
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request 4 IoCs
flow pid Process 32 2076 RUNDLL32.EXE 38 2076 RUNDLL32.EXE 39 2076 RUNDLL32.EXE 41 2076 RUNDLL32.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation RUNDLL32.EXE -
Loads dropped DLL 3 IoCs
pid Process 1064 rundll32.exe 1064 rundll32.exe 2076 RUNDLL32.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts RUNDLL32.EXE -
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RUNDLL32.EXE Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RUNDLL32.EXE Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RUNDLL32.EXE Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RUNDLL32.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
pid Process 2324 powershell.exe 60 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3628 5028 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUNDLL32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data RUNDLL32.EXE Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier RUNDLL32.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2324 powershell.exe 2324 powershell.exe 2076 RUNDLL32.EXE 2076 RUNDLL32.EXE 60 powershell.exe 60 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1064 rundll32.exe Token: SeDebugPrivilege 2076 RUNDLL32.EXE Token: SeDebugPrivilege 2324 powershell.exe Token: SeDebugPrivilege 60 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2076 RUNDLL32.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5028 wrote to memory of 1064 5028 a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe 86 PID 5028 wrote to memory of 1064 5028 a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe 86 PID 5028 wrote to memory of 1064 5028 a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe 86 PID 1064 wrote to memory of 2076 1064 rundll32.exe 91 PID 1064 wrote to memory of 2076 1064 rundll32.exe 91 PID 1064 wrote to memory of 2076 1064 rundll32.exe 91 PID 2076 wrote to memory of 2324 2076 RUNDLL32.EXE 92 PID 2076 wrote to memory of 2324 2076 RUNDLL32.EXE 92 PID 2076 wrote to memory of 2324 2076 RUNDLL32.EXE 92 PID 2076 wrote to memory of 60 2076 RUNDLL32.EXE 95 PID 2076 wrote to memory of 60 2076 RUNDLL32.EXE 95 PID 2076 wrote to memory of 60 2076 RUNDLL32.EXE 95 PID 60 wrote to memory of 2264 60 powershell.exe 97 PID 60 wrote to memory of 2264 60 powershell.exe 97 PID 60 wrote to memory of 2264 60 powershell.exe 97 PID 2076 wrote to memory of 2248 2076 RUNDLL32.EXE 100 PID 2076 wrote to memory of 2248 2076 RUNDLL32.EXE 100 PID 2076 wrote to memory of 2248 2076 RUNDLL32.EXE 100 PID 2076 wrote to memory of 4788 2076 RUNDLL32.EXE 103 PID 2076 wrote to memory of 4788 2076 RUNDLL32.EXE 103 PID 2076 wrote to memory of 4788 2076 RUNDLL32.EXE 103 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RUNDLL32.EXE -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RUNDLL32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8c0796d74fe9e34fe0c67a500dc7b32_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\A8C079~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\A8C079~1.EXE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\A8C079~1.DLL,aR9KfI0=3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2076 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp9EFF.tmp.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpAB84.tmp.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost5⤵
- System Location Discovery: System Language Discovery
PID:2264
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask4⤵
- System Location Discovery: System Language Discovery
PID:2248
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask4⤵
- System Location Discovery: System Language Discovery
PID:4788
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 5242⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5028 -ip 50281⤵PID:4060
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
2KB
MD56ad58b45ba900fe2b784c35fe1ddd496
SHA17701cf4dfebc92b77e3d16a4094dac0def34f13a
SHA256139a32ad96800367dc709be507e2b78e667610000be7c68f94c174e6fa60f84f
SHA512168f58da543d5c3a645c9a51916528c8e291f0f49069fb8567328e6960874a97026839a31a3505bcd1cc26320a477fbd095406ff3e12c4419c5429b729cd9c1a
-
Filesize
17KB
MD588649f8b7e5b60e6c73c7654e992f8bc
SHA1e733e1a13915ba0e26d8d0d9612fc0a429e1c9f9
SHA2568284694160e5c9d583311a4236e1e00ea6f56b17985d0488c78a76b8b9ee11a8
SHA512001e54a62c52ebb308f6a8125d18199fe33818586c1eeb615fedcb759d3ae8c2b796ca4dacaa3c48581bdee857071180fb25642b116abbfa0c67e86552033aed
-
Filesize
3.8MB
MD50fa776ebc6c175716ddae5d5ce2a5894
SHA13dbb9ac31089481cdba10345889f73d9acb59a02
SHA256fda53157a533ba28a067f49b29c517b1e7ac91cba890aa5bcb2ed245a036cdd7
SHA51255d11b53fe9134bf8b43a017591a27bedb9d539c5bac03e93cd3cd4a8a96b3f7030b9ad9fec373a0cf6e88a0776f32a3c57388dcb6114e895733fd45a5922b9e
-
Filesize
57KB
MD535d980fc217a8339451936395a7898e5
SHA13754d39933a0d05d17da673d35e7220f0950649e
SHA256a0c3f52d2dc241ffefa0f0555cb634e15b08520c919665b822c15cf44b1c774d
SHA51285e122b5652223aadbd84d850afa2cac4e78868e713628d39add945f7d0f76a8c0686c53c37d8d5dc0c5bdd89ee064ff7965d8d5cfbb76d2d95ce7fe767007b0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD54e81ac5d6924a73248882b52cef0bfe1
SHA18ec4883d08cd6e0c602866e3c119e03ff2331d61
SHA256d7b3a8608ba4ac05cb0c1673448f9fe89e5ff45cc58a893c1d272393a891d6b1
SHA512df87a0177e2f31dea063f6508abd19352e550a023a252d94072481f3483c9767ba9950c28582024ed83ca78f4b9f43be01889e30cdc7626e353be0e9f20bcf89
-
Filesize
261B
MD5de321f2e5f97a90272fddcacbf576778
SHA199ee5c83d661b091cc0cfc29dc5ddfb79c11d7f0
SHA2564f1d0820575841d9fb489e4a4618e55096023ebcda3c19f40f6b5ebc52e78d92
SHA5121e01ef9e335e26a32b3361184357aeb5bccb49c29891508967767ccd0e6107c260465e487cfeea4cf89b1abbc6f8cbe1ff8fa7094a681b4d55ecf90febdaeaf9
-
Filesize
1KB
MD5c416c12d1b2b1da8c8655e393b544362
SHA1fb1a43cd8e1c556c2d25f361f42a21293c29e447
SHA2560600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046
SHA512cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c
-
Filesize
80B
MD5299c6974d15d21c234c1c20d70856559
SHA168fc491d16f90d473da877510e4bcf2c9183548d
SHA2567c554dd49154dab22487f79d6537d6a0ad2225ba48bbdf36b60179b76b829be2
SHA512aeffb998763cc6a32d2306018c95cf298c6f61c1f4a445dd1222e06d452fbe96c1410458f930909120e1fc05cf779ea9ddbbf6ca3ee6fdf5a20dc5574122516d
-
Filesize
86B
MD51860260b2697808b80802352fe324782
SHA1f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b
SHA2560c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1
SHA512d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f