Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/10/2024, 00:59 UTC
General
-
Target
5a150f8752d5553cab3b640f33d0786e_JaffaCakes118.exe
-
Size
717KB
-
MD5
5a150f8752d5553cab3b640f33d0786e
-
SHA1
72b30709a7d5a824ce8f00397c1602ddda1cb05b
-
SHA256
c54c2f66a5691aa9b18c133ef391d36ae13cd4686ef4448ccd4ad5cb20d6e1d8
-
SHA512
ab2827d7fd0da87e0cde3ca88a150d565027730ad9770b8df015d32805f02b9831a7bdf1c6f890f792b7c402a34fd47031619117fbb8a27f0b0a79fbcafda7a8
-
SSDEEP
12288:kv9Lf/qlL2iNeHK7zgn1nyiV2BPWtgJ21xaCIRkdOwFllDOKtvalFFTof:kQR1bUn1tV2B+ACIKdOwFllD4po
Score
10/10
Malware Config
Extracted
Family
snakekeylogger
Credentials
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
newoffice@myexodus1.com - Password:
jBgPrcvY6 - Email To:
newoffice@myexodus1.com
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a150f8752d5553cab3b640f33d0786e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a150f8752d5553cab3b640f33d0786e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kUSrPlGlQFx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63B3.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\5a150f8752d5553cab3b640f33d0786e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a150f8752d5553cab3b640f33d0786e_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5a150f8752d5553cab3b640f33d0786e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a150f8752d5553cab3b640f33d0786e_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 15803⤵
- Program crash
-
-
Network
-
DNScheckip.dyndns.orgRemote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A193.122.6.168checkip.dyndns.comIN A158.101.44.242checkip.dyndns.comIN A193.122.130.0checkip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A132.226.8.169 -
GEThttp://checkip.dyndns.org/Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Sat, 19 Oct 2024 01:00:21 GMT
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 0fc9942bcc655ade4e55a90ac0f19586
-
GEThttp://checkip.dyndns.org/Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Date: Sat, 19 Oct 2024 01:00:24 GMT
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 8ce64017c58dadef554b748f2e9302d9
-
DNSfreegeoip.appRemote address:8.8.8.8:53Requestfreegeoip.appIN AResponsefreegeoip.appIN A172.67.160.84freegeoip.appIN A104.21.73.97
-
GEThttps://freegeoip.app/xml/138.199.29.44Remote address:172.67.160.84:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: freegeoip.app
Connection: Keep-Alive
ResponseHTTP/1.1 301 Moved Permanently
Date: Sat, 19 Oct 2024 01:00:27 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sat, 19 Oct 2024 02:00:27 GMT
Location: https://ipbase.com/xml/138.199.29.44
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JPOa7muAApwcgqgy6epqFYyxmAViRTFo1DuIBSLWkk%2BrsyhMkWSiMnm%2BIIEN2qFUkAoroD7MEVumgsHLiCGMJU%2BRCVMdzo106%2FJ67N0bQE4gaOsL2fOInwqM4ESxZ7Bz"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8d4cd4ce1c6c53a5-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=46826&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=368&delivery_rate=82888&cwnd=253&unsent_bytes=0&cid=12820576a2c0e727&ts=133&x=0"
-
DNSipbase.comRemote address:8.8.8.8:53Requestipbase.comIN AResponseipbase.comIN A172.67.209.71ipbase.comIN A104.21.85.189
-
GEThttps://ipbase.com/xml/138.199.29.44Remote address:172.67.209.71:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: ipbase.com
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Date: Sat, 19 Oct 2024 01:00:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Age: 0
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; fwd=miss
Vary: Accept-Encoding
X-Nf-Request-Id: 01JAH4MFFADCV2AMZK3GX1QJR7
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=376Bc2qtj2RmiMiWK0vk2CGEh8ZsZJgdfLretSIp1UPpcGbOPGrldnaxUwjlxwDknI4mAgTFdfGdVWkYjemFx2%2B2Ki8VVdGuL7kQ1dZJQLfcnMq8ny4QCK4VQA71"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8d4cd4cfcfc2bee9-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=46542&sent=6&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=365&delivery_rate=80817&cwnd=253&unsent_bytes=0&cid=35ed65e6084de3a3&ts=262&x=0"
-
193.122.6.168:80http://checkip.dyndns.org/http
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200 -
172.67.160.84:443https://freegeoip.app/xml/138.199.29.44tls, http
HTTP Request
GET https://freegeoip.app/xml/138.199.29.44HTTP Response
301 -
172.67.209.71:443https://ipbase.com/xml/138.199.29.44tls, http
HTTP Request
GET https://ipbase.com/xml/138.199.29.44HTTP Response
404
-
8.8.8.8:53checkip.dyndns.orgdns
DNS Request
checkip.dyndns.org
DNS Response
193.122.6.168158.101.44.242193.122.130.0132.226.247.73132.226.8.169
-
8.8.8.8:53freegeoip.appdns
DNS Request
freegeoip.app
DNS Response
172.67.160.84104.21.73.97
-
8.8.8.8:53ipbase.comdns
DNS Request
ipbase.com
DNS Response
172.67.209.71104.21.85.189
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59a40ddfd6cc989e9adeb73a5d3565e19
SHA13f74042136a0d868c862a08351d3411ea6805017
SHA2567e0e566eee4130a77e8a2ecb70e0d0aca993c1fb0f6c0853d14fae35686acf41
SHA512d52b04260b389a6a890fa7bb6041b6d26979fb701240796d5271e339b9bba9bd3c97de0c6091605030a7be7080f0baf35376996bd534c8d58aafc1057c1355a5
-
Filesize
4KB
-
Filesize
744KB
-
Filesize
6.9MB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
576KB
-
Filesize
144KB
-
Filesize
6.9MB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
6.9MB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB