Overview

overview

10

Static

static

3

d6146d239a...18.exe

windows7-x64

10

d6146d239a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 09:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d6146d239a05c6d745c1e3b28549e9f7_JaffaCakes118.exe

  • Size

    461KB

  • MD5

    d6146d239a05c6d745c1e3b28549e9f7

  • SHA1

    8f227101cdd53c7083e0d2e3a0ac183ef56695bd

  • SHA256

    567fe2998412b937355f663996f1a851aa06217d3f56626b3a6d8cae3194d194

  • SHA512

    a68bce77bba9fc1657090720e67cf890ac2af63f904ff7bcb9ba5100f5dff8fa0b0d40c3b35e004e41172ef539b96c1c7fee16c99428cc21ee531db88d01b630

  • SSDEEP

    12288:Jfh5MGx0fHY//YYZN1VI2BiwOhQxDEJdfEioqkY0:iU0fYIeNXGhyEJdN9kY0

Score
10/10
agentteslacollectioncredential_accessdiscoveryevasionkeyloggerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Rollingstone147

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Rollingstone147

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6146d239a05c6d745c1e3b28549e9f7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d6146d239a05c6d745c1e3b28549e9f7_JaffaCakes118.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pdgUXr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5F4.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:5020
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "{path}"
      2⤵
        PID:264
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "{path}"
        2⤵
          PID:1712
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
          "{path}"
          2⤵
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:620
          • C:\Windows\SysWOW64\netsh.exe
            "netsh" wlan show profile
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:5016

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      5
      T1012

      System Information Discovery

      4
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Wi-Fi Discovery

      1
      T1016.002

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Email Collection

      1
      T1114

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpA5F4.tmp
        Filesize

        1KB

        MD5

        d99f242a9c07b0d2589b715ccd96dc44

        SHA1

        901cf98c42f55d144f92a4ce02ae98ad8d6a801a

        SHA256

        85c6049f6cbfead23cccbbe80ceb3532192c5a9e53d798ddfcedc8a1395c6d2b

        SHA512

        97da4c4662ee8dd1af576abd22976c9e7da93e6f5a13057f0a14539ee3222e5eb7b63c0cd387505ce898ef0ad0cc633f1ab22711fdaa6e07c167a0919f959510

        Download Submit

      • memory/620-8-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/620-12-0x0000000074A40000-0x0000000074FF1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/620-10-0x0000000074A40000-0x0000000074FF1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/620-13-0x0000000074A40000-0x0000000074FF1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3196-0-0x0000000074A42000-0x0000000074A43000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3196-1-0x0000000074A40000-0x0000000074FF1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3196-2-0x0000000074A40000-0x0000000074FF1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3196-11-0x0000000074A40000-0x0000000074FF1000-memory.dmp

        Filesize

        5.7MB

        Download