Malware Analysis Report

2025-08-11 06:36

Sample ID 241015-2c3s6azhle
Target 4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118
SHA256 ae3e0875086c0c5df9492b15fad1dae8d5ab5a6cb70f6d2e8c2f732940657e4b
Tags
collection discovery persistence spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ae3e0875086c0c5df9492b15fad1dae8d5ab5a6cb70f6d2e8c2f732940657e4b

Threat Level: Known bad

The file 4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

collection discovery persistence spyware stealer upx

Detected Nirsoft tools

NirSoft MailPassView

Executes dropped EXE

Reads user/profile data of web browsers

Checks installed software on the system

Adds Run key to start application

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

UPX packed file

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-15 22:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-15 22:27

Reported

2024-10-15 22:29

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe"

Signatures

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\mailpv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\svh0st.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe" C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe" C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyip.com N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dialup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\passwordfox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\mspass.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromePass.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\mailpv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\produkey.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mspass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 684 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\dialup.exe
PID 684 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\dialup.exe
PID 684 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\dialup.exe
PID 684 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\dialup.exe
PID 684 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
PID 684 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
PID 684 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
PID 684 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
PID 684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mspass.exe
PID 684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mspass.exe
PID 684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mspass.exe
PID 684 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mspass.exe
PID 684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iepv.exe
PID 684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iepv.exe
PID 684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iepv.exe
PID 684 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iepv.exe
PID 684 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
PID 684 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
PID 684 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
PID 684 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
PID 684 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mailpv.exe
PID 684 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mailpv.exe
PID 684 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mailpv.exe
PID 684 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mailpv.exe
PID 684 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\produkey.exe
PID 684 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\produkey.exe
PID 684 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\produkey.exe
PID 684 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\produkey.exe
PID 684 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
PID 684 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
PID 684 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
PID 684 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\dialup.exe

C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\data.txt

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt

C:\Users\Admin\AppData\Local\Temp\mspass.exe

C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\mess.txt

C:\Users\Admin\AppData\Local\Temp\iepv.exe

C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt

C:\Users\Admin\AppData\Local\Temp\mailpv.exe

C:\Users\Admin\AppData\Local\Temp\mailpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mailpv.txt

C:\Users\Admin\AppData\Local\Temp\produkey.exe

C:\Users\Admin\AppData\Local\Temp\produkey.exe /stext C:\Users\Admin\AppData\Local\Temp\produkey.txt

C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\OperaPassView.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 whatismyip.com udp
US 104.27.206.92:80 whatismyip.com tcp
US 8.8.8.8:53 www.whatismyip.com udp
US 104.27.206.92:443 www.whatismyip.com tcp
US 104.27.206.92:443 www.whatismyip.com tcp
US 104.27.206.92:443 www.whatismyip.com tcp
US 104.27.206.92:443 www.whatismyip.com tcp
US 8.8.8.8:53 smtp.gmail.com udp
NL 172.217.218.108:587 smtp.gmail.com tcp

Files

memory/684-0-0x000007FEF57CE000-0x000007FEF57CF000-memory.dmp

memory/684-1-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

memory/684-2-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

memory/684-3-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dialup.exe

MD5 9c8872c879d0a9d82988920488370864
SHA1 87ff4231547462e6474c832e28831dd691d83fd4
SHA256 8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97
SHA512 3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e

memory/2972-8-0x0000000000400000-0x0000000000418000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\data.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2972-12-0x0000000000400000-0x0000000000418000-memory.dmp

memory/684-19-0x000007FEF57CE000-0x000007FEF57CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

MD5 a1d6a37917dcf4471486bc5a0e725cc6
SHA1 5b09f10dc215078ae44f535de12630c38f3b86e3
SHA256 8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17
SHA512 5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2

C:\Users\Admin\AppData\Local\Temp\mspass.exe

MD5 fbb93d4c91453b06414d6973152d904e
SHA1 4624232c5450e7e9e7ba1f2113a07f8800dc5b5f
SHA256 8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe
SHA512 4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

memory/684-22-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

memory/2620-28-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2812-27-0x0000000000400000-0x0000000000419000-memory.dmp

memory/2620-30-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iepv.exe

MD5 28c110b8d0ad095131c8d06043678086
SHA1 c684cf321e890e0e766a97609a4cde866156d6c5
SHA256 dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1
SHA512 065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

memory/1584-37-0x0000000000400000-0x000000000041B000-memory.dmp

memory/684-38-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

memory/1584-40-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe

MD5 9b3b1c0db965166319469b2afa6c4f0c
SHA1 9f1e65a3056dff872949329c4e5e70c007cc5621
SHA256 dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89
SHA512 c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

memory/2144-47-0x0000000000400000-0x000000000043D000-memory.dmp

memory/2144-51-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mailpv.exe

MD5 29beed02d9e57505cf5f34edf24dba1c
SHA1 12f3cb339c182bcc62a369a92db2da45aab64f5e
SHA256 dc64825cf0d635320d4f72e70695084faf548ded12e5daf7ebc335cad64bc1fd
SHA512 957a8b6cbd20e62fcef513b8a5078fb9944aa5f79d517ffa23334198d718ec0db8a33f3c2763898124f88b582a4018537fbdb35650c0f040897a328ba5b919be

memory/2908-58-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2908-60-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\produkey.exe

MD5 279c6d1ff7c0dc77d68b6013288b40a8
SHA1 21e3620bfab7fa8c9c8ff0414b52a8e3f23d1fc2
SHA256 8e2373e94bff10ecb08e9e0cdeaa65ed57aec89f99312d3bbd90ab72de4f98f3
SHA512 a7ab94cac449b9494419d1e6fb9ea3cdd58a1c455fb003b3376b5717655aa15669eebdcfefffd18958326f15526afdac9b8978b47769e901f06ac2c782fc7ecd

memory/2376-67-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2376-72-0x0000000000400000-0x0000000000418000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\produkey.txt

MD5 bd5d271dfacc55b4550e0ef833ea24b9
SHA1 acf1cccbac4223f3800453bd65f49a4001300e53
SHA256 d3e459f0a18a09ca18bcc8c8e4bbad5e20b89418d9ff65201345226cd8f5947d
SHA512 9f7b34016173d9b2b55537d18c887a2bc809757fda99f130708dbd51ed01fc83ae76cfb3e6569390c199286feb5e76360ee5ee1ed3a5893765a00c0cbb00c155

C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

MD5 37a89021ab1fbe5668c3974abc794bd4
SHA1 8ccaa4406f907a5a938fbb2db9d5af27092b811d
SHA256 2cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8
SHA512 6eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8

memory/1260-78-0x0000000000400000-0x0000000000419000-memory.dmp

memory/1260-82-0x0000000000400000-0x0000000000419000-memory.dmp

memory/684-83-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

memory/684-85-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

memory/2812-87-0x0000000000400000-0x0000000000419000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-15 22:27

Reported

2024-10-15 22:29

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe"

Signatures

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Temp\mailpv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe" C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svh0st.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe" C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A whatismyip.com N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\mailpv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\produkey.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dialup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\passwordfox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\mspass.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromePass.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mspass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mspass.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mspass.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\iepv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2040 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\dialup.exe
PID 2040 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\dialup.exe
PID 2040 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\dialup.exe
PID 2040 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
PID 2040 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
PID 2040 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
PID 2040 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mspass.exe
PID 2040 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mspass.exe
PID 2040 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mspass.exe
PID 2040 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iepv.exe
PID 2040 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iepv.exe
PID 2040 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iepv.exe
PID 2040 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
PID 2040 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
PID 2040 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
PID 2040 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mailpv.exe
PID 2040 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mailpv.exe
PID 2040 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\mailpv.exe
PID 2040 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\produkey.exe
PID 2040 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\produkey.exe
PID 2040 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\produkey.exe
PID 2040 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
PID 2040 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
PID 2040 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4a4b4167a08c3b6bf1a84186e9c51f11_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\dialup.exe

C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\data.txt

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt

C:\Users\Admin\AppData\Local\Temp\mspass.exe

C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\mess.txt

C:\Users\Admin\AppData\Local\Temp\iepv.exe

C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt

C:\Users\Admin\AppData\Local\Temp\mailpv.exe

C:\Users\Admin\AppData\Local\Temp\mailpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mailpv.txt

C:\Users\Admin\AppData\Local\Temp\produkey.exe

C:\Users\Admin\AppData\Local\Temp\produkey.exe /stext C:\Users\Admin\AppData\Local\Temp\produkey.txt

C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\OperaPassView.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 whatismyip.com udp
US 104.27.207.92:80 whatismyip.com tcp
US 8.8.8.8:53 www.whatismyip.com udp
US 104.27.206.92:443 www.whatismyip.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 92.207.27.104.in-addr.arpa udp
US 8.8.8.8:53 92.206.27.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 104.27.206.92:443 www.whatismyip.com tcp
US 8.8.8.8:53 smtp.gmail.com udp
NL 172.217.218.108:587 smtp.gmail.com tcp
US 8.8.8.8:53 108.218.217.172.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/2040-0-0x00007FF9FFD95000-0x00007FF9FFD96000-memory.dmp

memory/2040-1-0x000000001B5A0000-0x000000001B646000-memory.dmp

memory/2040-2-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

memory/2040-3-0x000000001BBF0000-0x000000001C0BE000-memory.dmp

memory/2040-4-0x000000001C0C0000-0x000000001C15C000-memory.dmp

memory/2040-5-0x0000000000E50000-0x0000000000E58000-memory.dmp

memory/2040-6-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

memory/2040-7-0x000000001C220000-0x000000001C26C000-memory.dmp

memory/2040-8-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

memory/2040-9-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

memory/2040-10-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

memory/2040-11-0x00007FF9FFD95000-0x00007FF9FFD96000-memory.dmp

memory/2040-12-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dialup.exe

MD5 9c8872c879d0a9d82988920488370864
SHA1 87ff4231547462e6474c832e28831dd691d83fd4
SHA256 8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97
SHA512 3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e

memory/1008-16-0x0000000000400000-0x0000000000418000-memory.dmp

memory/1008-21-0x0000000000400000-0x0000000000418000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\data.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

MD5 a1d6a37917dcf4471486bc5a0e725cc6
SHA1 5b09f10dc215078ae44f535de12630c38f3b86e3
SHA256 8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17
SHA512 5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2

memory/2040-26-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

memory/1092-27-0x0000000000400000-0x0000000000419000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mspass.exe

MD5 fbb93d4c91453b06414d6973152d904e
SHA1 4624232c5450e7e9e7ba1f2113a07f8800dc5b5f
SHA256 8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe
SHA512 4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

memory/1316-32-0x0000000000400000-0x0000000000425000-memory.dmp

memory/1316-33-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iepv.exe

MD5 28c110b8d0ad095131c8d06043678086
SHA1 c684cf321e890e0e766a97609a4cde866156d6c5
SHA256 dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1
SHA512 065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

memory/3016-40-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2040-38-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe

MD5 9b3b1c0db965166319469b2afa6c4f0c
SHA1 9f1e65a3056dff872949329c4e5e70c007cc5621
SHA256 dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89
SHA512 c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

memory/2040-50-0x00007FF9FFAE0000-0x00007FFA00481000-memory.dmp

memory/524-49-0x0000000000400000-0x000000000043D000-memory.dmp

memory/3964-53-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mailpv.exe

MD5 29beed02d9e57505cf5f34edf24dba1c
SHA1 12f3cb339c182bcc62a369a92db2da45aab64f5e
SHA256 dc64825cf0d635320d4f72e70695084faf548ded12e5daf7ebc335cad64bc1fd
SHA512 957a8b6cbd20e62fcef513b8a5078fb9944aa5f79d517ffa23334198d718ec0db8a33f3c2763898124f88b582a4018537fbdb35650c0f040897a328ba5b919be

memory/3964-56-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\produkey.exe

MD5 279c6d1ff7c0dc77d68b6013288b40a8
SHA1 21e3620bfab7fa8c9c8ff0414b52a8e3f23d1fc2
SHA256 8e2373e94bff10ecb08e9e0cdeaa65ed57aec89f99312d3bbd90ab72de4f98f3
SHA512 a7ab94cac449b9494419d1e6fb9ea3cdd58a1c455fb003b3376b5717655aa15669eebdcfefffd18958326f15526afdac9b8978b47769e901f06ac2c782fc7ecd

memory/4612-60-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4612-65-0x0000000000400000-0x0000000000418000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\produkey.txt

MD5 8093ed2ee11b67b936b1becd8de13110
SHA1 8cc737249b1d09ef0a6c52ff4d7d4d29851ec7dc
SHA256 d9fc141eee9478a0f631b03cdfa9599f4d9f5ff62255cb17dc4671f798ce0f98
SHA512 62003ce5267990d7588a3e5ab88d2664720ccc8504f6ad730b0f5757e4984b29dfe08103ee7ab5f46d199b8635b4d7ea214f339f8c20f47ba21b12b95eaec6d1

memory/5112-69-0x0000000000400000-0x0000000000419000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

MD5 37a89021ab1fbe5668c3974abc794bd4
SHA1 8ccaa4406f907a5a938fbb2db9d5af27092b811d
SHA256 2cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8
SHA512 6eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8

memory/5112-73-0x0000000000400000-0x0000000000419000-memory.dmp

memory/1092-76-0x0000000000400000-0x0000000000419000-memory.dmp