Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 04:47
Static task
static1
Behavioral task
behavioral1
Sample
f537fb649351697bab504875a6376248_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f537fb649351697bab504875a6376248_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f537fb649351697bab504875a6376248_JaffaCakes118.exe
-
Size
970KB
-
MD5
f537fb649351697bab504875a6376248
-
SHA1
a1172ce706c7cfe515bcc7d5bdc0fd4331229c68
-
SHA256
88db5475450967cf49cc6f8f167e0f4fdf0a52e098ec696d778d5b6a272958c5
-
SHA512
8a98705dbaf60d842a985c8529db8f3d48a1cc4ddf15f910f275be2d6c663b26c7ecfa63ce274e97dba21edc876997165f163a99dc01cacca9a78f0ec69b12c5
-
SSDEEP
24576:xoJb8qGbsCV4HJb31EpJZYDTDO7ctLHu:xEoT3KTEJZYDT6YtLH
Malware Config
Signatures
-
Detected Nirsoft tools 9 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2972-18-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/2972-21-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/2972-20-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/2500-28-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2500-29-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2500-30-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1416-31-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1416-32-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1416-38-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
NirSoft MailPassView 6 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/2972-18-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/2972-21-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/2972-20-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/2500-28-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2500-29-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2500-30-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2972-18-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/2972-21-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/2972-20-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1416-31-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1416-32-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1416-38-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Executes dropped EXE 2 IoCs
pid Process 1804 project7912.exe 2972 project7912.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Desktop\\project7912.exe -boot" project7912.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" project7912.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyipaddress.com 4 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1804 set thread context of 2972 1804 project7912.exe 37 PID 2972 set thread context of 2500 2972 project7912.exe 39 PID 2972 set thread context of 1416 2972 project7912.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project7912.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language project7912.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f537fb649351697bab504875a6376248_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1416 vbc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe Token: SeDebugPrivilege 1804 project7912.exe Token: SeDebugPrivilege 2972 project7912.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2972 project7912.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3036 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 30 PID 2932 wrote to memory of 3036 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 30 PID 2932 wrote to memory of 3036 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 30 PID 2932 wrote to memory of 3036 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2924 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 34 PID 2932 wrote to memory of 2924 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 34 PID 2932 wrote to memory of 2924 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 34 PID 2932 wrote to memory of 2924 2932 f537fb649351697bab504875a6376248_JaffaCakes118.exe 34 PID 2924 wrote to memory of 1804 2924 cmd.exe 36 PID 2924 wrote to memory of 1804 2924 cmd.exe 36 PID 2924 wrote to memory of 1804 2924 cmd.exe 36 PID 2924 wrote to memory of 1804 2924 cmd.exe 36 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 1804 wrote to memory of 2972 1804 project7912.exe 37 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 2500 2972 project7912.exe 39 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40 PID 2972 wrote to memory of 1416 2972 project7912.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\f537fb649351697bab504875a6376248_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f537fb649351697bab504875a6376248_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f537fb649351697bab504875a6376248_JaffaCakes118.exe" "C:\Users\Admin\Desktop\project7912.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3036
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\project7912.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\Desktop\project7912.exe"C:\Users\Admin\Desktop\project7912.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\Desktop\project7912.exe"C:\Users\Admin\Desktop\project7912.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2500
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1416
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
970KB
MD5f537fb649351697bab504875a6376248
SHA1a1172ce706c7cfe515bcc7d5bdc0fd4331229c68
SHA25688db5475450967cf49cc6f8f167e0f4fdf0a52e098ec696d778d5b6a272958c5
SHA5128a98705dbaf60d842a985c8529db8f3d48a1cc4ddf15f910f275be2d6c663b26c7ecfa63ce274e97dba21edc876997165f163a99dc01cacca9a78f0ec69b12c5