Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 14:59

General

  • Target

    8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe

  • Size

    909KB

  • MD5

    8363557176af3185d1d9d7a786d45da2

  • SHA1

    c82dcf4920c5db1f3178c86c42ea0c00a1676387

  • SHA256

    3ef74b6463840fce135b1b38b7f1dfdf88954105a2b270603b289bbc3c3f9002

  • SHA512

    9db5019c8282d6ff6d91139fd66d5649aa1a8176b19236c7e4504000d1896533e1623198b5e607814c3b8fd7c5b0b21a0aa917ea0859be2e95cd71215142cb06

  • SSDEEP

    24576:coR6qgSD/7iCZ3exdG7ssq5gsC0nIOMyz:Ps7XXOsz/IOMa

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtppro.zoho.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    onyedikachi1

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • AgentTesla payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        PID:3280
      • C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        PID:1820
      • C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1916

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

          Filesize

          86KB

          MD5

          3b73078a714bf61d1c19ebc3afc0e454

          SHA1

          9abeabd74613a2f533e2244c9ee6f967188e4e7e

          SHA256

          ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

          SHA512

          75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe.log

          Filesize

          1KB

          MD5

          17573558c4e714f606f997e5157afaac

          SHA1

          13e16e9415ceef429aaf124139671ebeca09ed23

          SHA256

          c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

          SHA512

          f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

        • C:\Users\Admin\AppData\Local\Temp\3582-490\8363557176af3185d1d9d7a786d45da2_JaffaCakes118.exe

          Filesize

          869KB

          MD5

          dc48298f19bb6f6fb30f997d6f327b15

          SHA1

          11fc8d48bf253e4b79a82947ec2685b04556d1f3

          SHA256

          82a617b8169608e73ce761f98793ee01e8d6c936bd2f0a7048f1fcb9bea283c8

          SHA512

          babd22997d743be0e70acdc16ffd7359c1f152fecf8f9933b8e08cba4f452b4ae6a7b6b6eab5c393ea9b40ead332bf49de04079ada4a081302be99390ced4d95

        • memory/1916-121-0x0000000005D20000-0x0000000005D38000-memory.dmp

          Filesize

          96KB

        • memory/1916-124-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/1916-123-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/1916-122-0x00000000067D0000-0x0000000006836000-memory.dmp

          Filesize

          408KB

        • memory/1916-125-0x00000000069E0000-0x0000000006A30000-memory.dmp

          Filesize

          320KB

        • memory/1916-114-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/1916-120-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/1916-126-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/1916-118-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/1916-127-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/1944-104-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1944-107-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1944-109-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/2328-18-0x0000000005B50000-0x0000000005BA6000-memory.dmp

          Filesize

          344KB

        • memory/2328-111-0x0000000008440000-0x000000000847C000-memory.dmp

          Filesize

          240KB

        • memory/2328-110-0x0000000009800000-0x00000000098A4000-memory.dmp

          Filesize

          656KB

        • memory/2328-106-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2328-105-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

          Filesize

          4KB

        • memory/2328-119-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2328-20-0x0000000005EC0000-0x0000000005EDA000-memory.dmp

          Filesize

          104KB

        • memory/2328-19-0x0000000073F00000-0x00000000746B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2328-17-0x0000000005990000-0x000000000599A000-memory.dmp

          Filesize

          40KB

        • memory/2328-16-0x00000000059F0000-0x0000000005A82000-memory.dmp

          Filesize

          584KB

        • memory/2328-15-0x0000000005F00000-0x00000000064A4000-memory.dmp

          Filesize

          5.6MB

        • memory/2328-14-0x00000000058B0000-0x000000000594C000-memory.dmp

          Filesize

          624KB

        • memory/2328-13-0x0000000000E60000-0x0000000000F40000-memory.dmp

          Filesize

          896KB

        • memory/2328-12-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

          Filesize

          4KB