Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 17:06
Static task
static1
Behavioral task
behavioral1
Sample
e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe
-
Size
128KB
-
MD5
e0a2f2c57af359d30015a8cf3b8f1d62
-
SHA1
2e2ddd8e55170939c7ca318a9b90fe67e97e07c3
-
SHA256
8885755dd515d44a9d7b9101de8775f77a2b415648543c7140a44af003c99ce0
-
SHA512
568d95900a9ce06a2a10d112726aee77b49526be2b0d81486c94dcdc5d43d5c8ed536a807083570ea9b5bd11f6a7a3cbdfee451df68399d728fac5c37fca6009
-
SSDEEP
3072:uGHi6mwKnMCiGnivTqE5XxnptiaxHPTvFG/W:+5nQGnibqEdti0TvFw
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://216.231.139.111/forum/viewtopic.php
-
payload_url
http://fuerzav.vectorialstudios.com/4Gxf.exe
http://riegotec.com.mx/fgGq.exe
http://modaitaliaclub.com/LdKtM6.exe
http://successwithmichael.com/Dj8vftG.exe
http://piscinasangra.com/oP3yge.exe
http://p933.phpnet.org/0uVk8W2Z.exe
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1500 set thread context of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeImpersonatePrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Token: SeTcbPrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Token: SeCreateTokenPrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Token: SeBackupPrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Token: SeRestorePrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 4620 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 PID 1500 wrote to memory of 4620 1500 e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe 94 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e0a2f2c57af359d30015a8cf3b8f1d62_JaffaCakes118.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:4620
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300929_14U14WCS4159DH3B0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317300929_14U14WCS4159DH3B0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 836390
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 24F7C0FE270548E2B10CA1F13AE23FAF Ref B: LON04EDGE1205 Ref C: 2024-09-14T17:06:41Z
date: Sat, 14 Sep 2024 17:06:40 GMT
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request10.27.171.150.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request136.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request35.56.20.217.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239317300929_14U14WCS4159DH3B0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90tls, http230.0kB 871.5kB 636 634
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300929_14U14WCS4159DH3B0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200 -
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
208 B 4
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
10.27.171.150.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
136.32.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
241.150.49.20.in-addr.arpa
DNS Request
241.150.49.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
71 B 131 B 1 1
DNS Request
35.56.20.217.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa