Malware Analysis Report

2024-10-19 10:27

Sample ID 241012-r5s5bawbkf
Target 3a965754e28255e17381331c733a5062_JaffaCakes118
SHA256 f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6
Tags
isrstealer collection discovery spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6

Threat Level: Known bad

The file 3a965754e28255e17381331c733a5062_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

isrstealer collection discovery spyware stealer trojan upx

ISR Stealer payload

ISR Stealer

Detected Nirsoft tools

NirSoft MailPassView

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-12 14:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-12 14:46

Reported

2024-10-12 14:49

Platform

win7-20240903-en

Max time kernel

141s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\LFPKG.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LFPKG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LFPKG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LFPKG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 2076 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe
PID 1284 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 1284 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 1284 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 1284 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe
PID 2992 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\LFPKG.exe C:\Users\Admin\AppData\Local\Temp\LFPKG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\LFPKG.exe

"C:\Users\Admin\AppData\Local\Temp\LFPKG.exe"

C:\Users\Admin\AppData\Local\Temp\LFPKG.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\BGPDnx0hm0.ini"

C:\Users\Admin\AppData\Local\Temp\LFPKG.exe

/scomma "C:\Users\Admin\AppData\Local\Temp\lD4uMVMqSp.ini"

Network

Country Destination Domain Proto
US 8.8.8.8:53 skajyneos.hostzi.com udp
US 153.92.0.100:80 skajyneos.hostzi.com tcp

Files

memory/2076-2-0x0000000001D70000-0x0000000001D71000-memory.dmp

memory/2076-4-0x0000000001D70000-0x0000000001D71000-memory.dmp

memory/2076-6-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

memory/2076-8-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

memory/2076-10-0x0000000002C70000-0x0000000002C71000-memory.dmp

memory/2076-12-0x0000000002C70000-0x0000000002C71000-memory.dmp

memory/2076-14-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2076-16-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2076-32-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

memory/2076-18-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

memory/2076-20-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

memory/2076-22-0x00000000030E0000-0x00000000030E1000-memory.dmp

memory/2076-24-0x00000000030E0000-0x00000000030E1000-memory.dmp

memory/2076-40-0x00000000002D0000-0x00000000002D1000-memory.dmp

memory/2076-50-0x0000000002E50000-0x0000000002E51000-memory.dmp

memory/2076-60-0x0000000003040000-0x0000000003041000-memory.dmp

memory/2076-68-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2076-78-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

memory/2076-89-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2076-91-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2076-94-0x00000000032E0000-0x00000000032E1000-memory.dmp

memory/2076-102-0x0000000003250000-0x0000000003251000-memory.dmp

memory/2076-112-0x0000000003010000-0x0000000003011000-memory.dmp

memory/2076-126-0x00000000034B0000-0x00000000034B1000-memory.dmp

memory/2076-134-0x0000000002D50000-0x0000000002D51000-memory.dmp

memory/2076-144-0x00000000034A0000-0x00000000034A1000-memory.dmp

memory/2076-151-0x0000000002C80000-0x0000000002D3A000-memory.dmp

memory/2076-152-0x0000000003470000-0x0000000003471000-memory.dmp

memory/2076-157-0x0000000003240000-0x0000000003241000-memory.dmp

memory/2076-162-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

memory/2076-167-0x0000000003690000-0x0000000003691000-memory.dmp

\Users\Admin\AppData\Local\Temp\dup2patcher.dll

MD5 43bcd632e19ac3fdc43e7958465ce835
SHA1 30454241e95b78ddb125a4c784f160609589ee5f
SHA256 7694627600115240b503f214cbfb9106415802c345e982c3bf9c8d05910a1a7c
SHA512 ffe7507bcc2413a5b846ec62b9edd3ec94d79a2fd3ecaf4ce2ddb96a7d42facdfa9aabd84d06e15ab644ae478715c566a91e9bb8ba12fc9ff9a3b8390ca6d886

memory/1284-318-0x0000000000400000-0x0000000000449000-memory.dmp

memory/912-325-0x0000000074F60000-0x0000000074F86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LFPKG.exe

MD5 82ce6a2616f9b8e7c9037df683083524
SHA1 bcdef4e3b26634d84f5c02148a7b720a3c434407
SHA256 5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42
SHA512 10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

memory/2476-348-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2476-354-0x0000000000400000-0x0000000000453000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BGPDnx0hm0.ini

MD5 d1ea279fb5559c020a1b4137dc4de237
SHA1 db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256 fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512 720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

memory/1284-356-0x0000000000400000-0x0000000000449000-memory.dmp

memory/2900-366-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2900-371-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1284-374-0x0000000000400000-0x0000000000449000-memory.dmp

memory/912-379-0x0000000074F60000-0x0000000074F86000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-12 14:46

Reported

2024-10-12 14:49

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\3a965754e28255e17381331c733a5062_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3116 -ip 3116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 468

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/3116-2-0x00000000007C0000-0x00000000007C1000-memory.dmp

memory/3116-3-0x0000000002270000-0x0000000002271000-memory.dmp