Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27-08-2024 08:33
Static task
static1
Behavioral task
behavioral1
Sample
c4a66759f1e79cd39c53f633b75a42a3_JaffaCakes118.ps1
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c4a66759f1e79cd39c53f633b75a42a3_JaffaCakes118.ps1
Resource
win10v2004-20240802-en
General
-
Target
c4a66759f1e79cd39c53f633b75a42a3_JaffaCakes118.ps1
-
Size
499KB
-
MD5
c4a66759f1e79cd39c53f633b75a42a3
-
SHA1
e2ecc764ad94a4aebd30c1b1b97365ac84676907
-
SHA256
1416fcbe8c13e020ed59b1da68f09c8d7f7de47d099ea4d4abd41cfbee05b9b1
-
SHA512
fa37ed15716f424f19d849c726d8ba3dad5e4c083c5d1ff96e25cbc6de284c2b3d730bff1870e2c8ffadea8539bd116dab93131a14f44a0cb39059fdec59c01b
-
SSDEEP
12288:KZv1f3cDuHITp6lGNGtsNTe8FqQ8j17H2dp:KrfMfTDzNTf4Q7
Malware Config
Extracted
lokibot
http://higomanga.info/sky9/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request 5 IoCs
Processes:
cmd.exeflow pid process 3 18112 cmd.exe 4 18112 cmd.exe 5 18112 cmd.exe 6 18112 cmd.exe 7 18112 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
gyq.exepid process 2560 gyq.exe -
Loads dropped DLL 2 IoCs
Processes:
gyq.exepid process 2560 gyq.exe 2560 gyq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cmd.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook cmd.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
gyq.exedescription ioc process File opened for modification C:\Windows\win.ini gyq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
gyq.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exegyq.exepid process 2368 powershell.exe 2560 gyq.exe 2560 gyq.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
gyq.exepid process 2560 gyq.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.execmd.exedescription pid process Token: SeDebugPrivilege 2368 powershell.exe Token: SeDebugPrivilege 18112 cmd.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
powershell.exegyq.exedescription pid process target process PID 2368 wrote to memory of 2560 2368 powershell.exe gyq.exe PID 2368 wrote to memory of 2560 2368 powershell.exe gyq.exe PID 2368 wrote to memory of 2560 2368 powershell.exe gyq.exe PID 2368 wrote to memory of 2560 2368 powershell.exe gyq.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe PID 2560 wrote to memory of 18112 2560 gyq.exe cmd.exe -
outlook_office_path 1 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmd.exe -
outlook_win_path 1 IoCs
Processes:
cmd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook cmd.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c4a66759f1e79cd39c53f633b75a42a3_JaffaCakes118.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Public\gyq.exe"C:\Users\Public\gyq.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:18112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2703099537-420551529-3771253338-1000\0f5007522459c86e95ffcc62f32308f1_4b15cc6c-8bd6-4727-90f6-cf303c4bde6d
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
Filesize
355KB
MD58cee26303b6f0ede0db8cbe5a9baeeab
SHA1a4920e4504f90301e8eaecfabedeac09fae0949b
SHA256df87ea2fbfd7fc2eaf84f59375d57c10c044692b354ef682ff2f62356cbb3700
SHA512e65bdbada5f9f45c1da4acd37a034fb326fbb3d5ee8c74e8f6083ee4225feb4dcb22f2638872e30e9d3c21d4a7b4ffbaa263e7d0d59dc3cf756f52701abddb50
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
11KB
MD5eb2408a137927f9a7f6941aaa524ea2d
SHA16e3ffb190ecc53aa8a6caa5a0efab7a13dba339e
SHA2562f26a6c0c75fed429351f3ec031575f7fb24d1662836daede04572461b1ea7a0
SHA512daff54303abd27463d63cf1f90303ea7bf7487a380ad26dbe03dc747d8868a00643d7a0460b956debacd59838d861974715b74f097dd34c35f79fe29852b9cff