Overview
overview
10Static
static
3f97f261075...18.exe
windows7-x64
10f97f261075...18.exe
windows10-2004-x64
10$APPDATA/s...60.dll
windows7-x64
1$APPDATA/s...60.dll
windows10-2004-x64
1$APPDATA/s...er.dll
windows7-x64
1$APPDATA/s...er.dll
windows10-2004-x64
1$APPDATA/s...ui.dll
windows7-x64
1$APPDATA/s...ui.dll
windows10-2004-x64
1$APPDATA/s...ls.dll
windows7-x64
3$APPDATA/s...ls.dll
windows10-2004-x64
3$APPDATA/w...t2.exe
windows7-x64
$APPDATA/w...t2.exe
windows10-2004-x64
$APPDATA/w...ms.dll
windows7-x64
1$APPDATA/w...ms.dll
windows10-2004-x64
1$TEMP/Tenr...ar.dll
windows7-x64
10$TEMP/Tenr...ar.dll
windows10-2004-x64
10$TEMP/crm/...te.dll
windows7-x64
1$TEMP/crm/...te.dll
windows10-2004-x64
1$TEMP/crm/...dm.exe
windows7-x64
1$TEMP/crm/...dm.exe
windows10-2004-x64
1$TEMP/rede...UI.dll
windows7-x64
1$TEMP/rede...UI.dll
windows10-2004-x64
1Analysis
-
max time kernel
103s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 01:53
Static task
static1
Behavioral task
behavioral1
Sample
f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/scriptlibrary/39.opends60.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/scriptlibrary/39.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/scriptlibrary/MCppCodeDomProvider.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/scriptlibrary/MCppCodeDomProvider.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$APPDATA/scriptlibrary/autolaytui.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$APPDATA/scriptlibrary/autolaytui.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$APPDATA/stow/gutils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$APPDATA/stow/gutils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$APPDATA/with/count/ConmanClient2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
$APPDATA/with/count/ConmanClient2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$APPDATA/with/count/MicrosoftWindowsCEForms.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
$APPDATA/with/count/MicrosoftWindowsCEForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/TenrecSaggar.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/TenrecSaggar.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/crm/IEExecRemote.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/crm/IEExecRemote.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/crm/StoreAdm.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/crm/StoreAdm.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/redesign/pbo/ProjWizUI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/redesign/pbo/ProjWizUI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe
-
Size
341KB
-
MD5
f97f261075ab2aa2bffa7e55db878dd9
-
SHA1
09dbd7df952f5f3ab1b6ee6e4198a9458266d7a2
-
SHA256
2693c1048a5575cbb920552530ee1f8ff2599099dc079888e63f39aadb884382
-
SHA512
fd5ba2b8fb1782103f0a37e915fbb3fd7f860f814e9da29df9a7baceaeae78f83fa731ed8db5da098c705c4a9c020d6ced52a833f967ad49c93a08fe4072a9b3
-
SSDEEP
6144:JPCganNi8Kyg7TP3r3RpUDbzYsxf00vhau4TagGr2nBPsZ5m4sVKozq1WiLXb3:HanE85g3Pb3rsA0JaOgtZOOKzwiLXD
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nusatek.com - Port:
587 - Username:
[email protected] - Password:
nusatek187753d - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/3576-26-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
pid Process 852 rundll32.exe -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 852 rundll32.exe 3576 MSBuild.exe 3576 MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 852 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3576 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3576 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 852 1632 f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe 82 PID 1632 wrote to memory of 852 1632 f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe 82 PID 1632 wrote to memory of 852 1632 f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe 82 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 PID 852 wrote to memory of 3576 852 rundll32.exe 83 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe TenrecSaggar,Output2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181KB
MD54e4b6f8b78c1e03aad93a0dd137de8db
SHA189d2b2bbe9d52a83ae2ba40ca44b9fd400737ea1
SHA256b924e9a8c58f653af135bf8d5cc78499675f87248e7c24c27bc474580d90edb4
SHA512827f2dca97c8b7cf1498a82394298d6e1aa2daf96d27087a382654f3bae4d1ee2a99463e093920f45baca7c86ce5f1a51b372c04f10af8c8e8ea19d499f8366e
-
Filesize
43KB
MD5edb845779d91dcc37810eec0f029dfd3
SHA18ed5905bf015d0f7508b2af8b6be79a368aceada
SHA256785275c1afb2a166f159c391a21afe5d82c30cc479a7837c28abb89adff67b87
SHA512829b227037b4e3be5811b396ebaf7dbffb1ada24d955025d96f81a61d774c400b6c3997133f72cb1a601a7de60033baef344333bc8cd8749628eac4d206f2016