Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 22:27

General

  • Target

    4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe

  • Size

    563KB

  • MD5

    4a4b4167a08c3b6bf1a84186e9c51f11

  • SHA1

    3e483c4a4a4a44c7544197afcf8faaacaaf413c1

  • SHA256

    ae3e0875086c0c5df9492b15fad1dae8d5ab5a6cb70f6d2e8c2f732940657e4b

  • SHA512

    679f3e3232b3942768ab99fbc4be8fcc0613ac749a44d4be68b7c798839574a596eb188c9f56e6c2c58e9a5b63b558d65554a5bd1b1766f72071911619f5d3d0

  • SSDEEP

    12288:EiYco+gunQUBCEAWfykqVNe3U24eoz8LWy+:ENZunQU1aVNe3U24QLWy+

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    58913041

Signatures

  • Detected Nirsoft tools 10 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\dialup.exe
      C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\data.txt
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1008
    • C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
      C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1092
    • C:\Users\Admin\AppData\Local\Temp\mspass.exe
      C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\mess.txt
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1316
    • C:\Users\Admin\AppData\Local\Temp\iepv.exe
      C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3016
    • C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
      C:\Users\Admin\AppData\Local\Temp\ChromePass.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:524
    • C:\Users\Admin\AppData\Local\Temp\mailpv.exe
      C:\Users\Admin\AppData\Local\Temp\mailpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mailpv.txt
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook accounts
      • System Location Discovery: System Language Discovery
      PID:3964
    • C:\Users\Admin\AppData\Local\Temp\produkey.exe
      C:\Users\Admin\AppData\Local\Temp\produkey.exe /stext C:\Users\Admin\AppData\Local\Temp\produkey.txt
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4612
    • C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
      C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\OperaPassView.txt
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5112

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ChromePass.exe

          Filesize

          125KB

          MD5

          9b3b1c0db965166319469b2afa6c4f0c

          SHA1

          9f1e65a3056dff872949329c4e5e70c007cc5621

          SHA256

          dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89

          SHA512

          c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

        • C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

          Filesize

          38KB

          MD5

          37a89021ab1fbe5668c3974abc794bd4

          SHA1

          8ccaa4406f907a5a938fbb2db9d5af27092b811d

          SHA256

          2cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8

          SHA512

          6eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8

        • C:\Users\Admin\AppData\Local\Temp\data.txt

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Local\Temp\dialup.exe

          Filesize

          37KB

          MD5

          9c8872c879d0a9d82988920488370864

          SHA1

          87ff4231547462e6474c832e28831dd691d83fd4

          SHA256

          8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97

          SHA512

          3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e

        • C:\Users\Admin\AppData\Local\Temp\iepv.exe

          Filesize

          42KB

          MD5

          28c110b8d0ad095131c8d06043678086

          SHA1

          c684cf321e890e0e766a97609a4cde866156d6c5

          SHA256

          dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1

          SHA512

          065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

        • C:\Users\Admin\AppData\Local\Temp\mailpv.exe

          Filesize

          49KB

          MD5

          29beed02d9e57505cf5f34edf24dba1c

          SHA1

          12f3cb339c182bcc62a369a92db2da45aab64f5e

          SHA256

          dc64825cf0d635320d4f72e70695084faf548ded12e5daf7ebc335cad64bc1fd

          SHA512

          957a8b6cbd20e62fcef513b8a5078fb9944aa5f79d517ffa23334198d718ec0db8a33f3c2763898124f88b582a4018537fbdb35650c0f040897a328ba5b919be

        • C:\Users\Admin\AppData\Local\Temp\mspass.exe

          Filesize

          63KB

          MD5

          fbb93d4c91453b06414d6973152d904e

          SHA1

          4624232c5450e7e9e7ba1f2113a07f8800dc5b5f

          SHA256

          8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe

          SHA512

          4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

        • C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

          Filesize

          37KB

          MD5

          a1d6a37917dcf4471486bc5a0e725cc6

          SHA1

          5b09f10dc215078ae44f535de12630c38f3b86e3

          SHA256

          8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17

          SHA512

          5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2

        • C:\Users\Admin\AppData\Local\Temp\produkey.exe

          Filesize

          35KB

          MD5

          279c6d1ff7c0dc77d68b6013288b40a8

          SHA1

          21e3620bfab7fa8c9c8ff0414b52a8e3f23d1fc2

          SHA256

          8e2373e94bff10ecb08e9e0cdeaa65ed57aec89f99312d3bbd90ab72de4f98f3

          SHA512

          a7ab94cac449b9494419d1e6fb9ea3cdd58a1c455fb003b3376b5717655aa15669eebdcfefffd18958326f15526afdac9b8978b47769e901f06ac2c782fc7ecd

        • C:\Users\Admin\AppData\Local\Temp\produkey.txt

          Filesize

          726B

          MD5

          8093ed2ee11b67b936b1becd8de13110

          SHA1

          8cc737249b1d09ef0a6c52ff4d7d4d29851ec7dc

          SHA256

          d9fc141eee9478a0f631b03cdfa9599f4d9f5ff62255cb17dc4671f798ce0f98

          SHA512

          62003ce5267990d7588a3e5ab88d2664720ccc8504f6ad730b0f5757e4984b29dfe08103ee7ab5f46d199b8635b4d7ea214f339f8c20f47ba21b12b95eaec6d1

        • memory/524-49-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

        • memory/1008-16-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/1008-21-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/1092-76-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/1092-27-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/1316-33-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/1316-32-0x0000000000400000-0x0000000000425000-memory.dmp

          Filesize

          148KB

        • memory/2040-4-0x000000001C0C0000-0x000000001C15C000-memory.dmp

          Filesize

          624KB

        • memory/2040-11-0x00007FF9FFD95000-0x00007FF9FFD96000-memory.dmp

          Filesize

          4KB

        • memory/2040-5-0x0000000000E50000-0x0000000000E58000-memory.dmp

          Filesize

          32KB

        • memory/2040-0-0x00007FF9FFD95000-0x00007FF9FFD96000-memory.dmp

          Filesize

          4KB

        • memory/2040-6-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-12-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-7-0x000000001C220000-0x000000001C26C000-memory.dmp

          Filesize

          304KB

        • memory/2040-8-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-38-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-3-0x000000001BBF0000-0x000000001C0BE000-memory.dmp

          Filesize

          4.8MB

        • memory/2040-50-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-26-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-1-0x000000001B5A0000-0x000000001B646000-memory.dmp

          Filesize

          664KB

        • memory/2040-2-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-9-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/2040-10-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

          Filesize

          9.6MB

        • memory/3016-40-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3964-56-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/3964-53-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/4612-60-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/4612-65-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/5112-69-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/5112-73-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB