Analysis
-
max time kernel
136s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20250619-en -
resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/07/2025, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe
Resource
win11-20250619-en
General
-
Target
JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe
-
Size
840KB
-
MD5
1c6fc2393299d2d87d9632e098ffdb4a
-
SHA1
79e3211d95ffb7292cd40f6623057b74d16ff8e8
-
SHA256
9c9849127fd8fd77ce72881e7576d86a24ca28df820118211ecd26a2e78244e3
-
SHA512
e766f2df701f277de3a4442cab805622bb03ba80729e65756ea5d012d63e2bee745841fea58ae1d5e163ab0d220c4e4594ee157e51fefe1898f222dcaec0cce8
-
SSDEEP
12288:zXCtdl5OONKZAROENtCu3KLmDj0JHVrQYdowNwMsy5SEI99lHOyLyaUVKnp:gf5rNKZAwENL3KLmDoGwhsqSXluRahp
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.logoffices.com - Port:
587 - Username:
[email protected] - Password:
W+t+zhpMCR2@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/5116-40-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1580 powershell.exe 1028 powershell.exe 5044 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe Key opened \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe Key opened \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 464 set thread context of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2324 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1580 powershell.exe 1028 powershell.exe 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 5116 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 5116 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 1580 powershell.exe 5044 powershell.exe 1028 powershell.exe 5044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1580 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeDebugPrivilege 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe Token: SeDebugPrivilege 5116 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe Token: SeDebugPrivilege 5044 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 464 wrote to memory of 1580 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 78 PID 464 wrote to memory of 1580 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 78 PID 464 wrote to memory of 1580 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 78 PID 464 wrote to memory of 1028 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 80 PID 464 wrote to memory of 1028 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 80 PID 464 wrote to memory of 1028 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 80 PID 464 wrote to memory of 2324 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 82 PID 464 wrote to memory of 2324 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 82 PID 464 wrote to memory of 2324 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 82 PID 464 wrote to memory of 5044 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 84 PID 464 wrote to memory of 5044 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 84 PID 464 wrote to memory of 5044 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 84 PID 464 wrote to memory of 5052 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 85 PID 464 wrote to memory of 5052 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 85 PID 464 wrote to memory of 5052 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 85 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 PID 464 wrote to memory of 5116 464 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe 87 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-707770698-2523217751-1187874351-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PKVYKaehCh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PKVYKaehCh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp23EE.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2324
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PKVYKaehCh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe"2⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c6fc2393299d2d87d9632e098ffdb4a.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5116
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
Filesize
18KB
MD5bb3d189fceefbdb98e4f3fd744494c15
SHA1806bf9b0a4123111b97df6628af7a27395947e3a
SHA25675a700422acc3e3da7e24351930c3d16fdc2c73097ad5f23cf3e33346a111830
SHA5126e8ee69607d78fe22a19177e5345513316da360156899f4cca396f4e2961ab43d5c30dc35cab66d6ad115bb95fd6b340b1e5874fd397f60b34c360a843adf0d1
-
Filesize
255B
MD595d70f80572cc70b3fd9ca270f54a48b
SHA142a3106bdd96e5d1aaf2d3df463ecf142fdb614b
SHA256ab5a7069401f8f3d02a2146e7fe9a256a397900500ca20e28d5d92a4ac0cba41
SHA512f415259cf79a598a3658ecdc1b592b2ab10588eb447592efd2d6159421270a691e4ed6259b56d8a5b41a17b4ecfb19438a44ba111656b69e223d35faae562464
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD58f268393c5eb50d8eeda69b3a6e30786
SHA110d465ff04c05936dfe393e0b0abff6b94db14aa
SHA2568f3e9da0c915cde776a604bebbd7640508caf71929f770f5babef58266f424a7
SHA512abd30140ad3e0f7ceaee438c5f9d71c63e1d5a688500863696d20ff1b0f36f1bbf4a47c097024b4f65b9a5e5bb354239cd786d3d873f3ff21d491051cd0c696a