Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 15:48
Static task
static1
Behavioral task
behavioral1
Sample
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe
-
Size
63KB
-
MD5
9568c589eb240860758e5b783bc1d379
-
SHA1
694a7b0fac2c471da6306568efbce1e67199c91d
-
SHA256
9366eb74a0e59bcfed242ad625acdc2dc908a581bb6d4596220de5cf8f4ac7f3
-
SHA512
c3cd9401acebbd61804325678fff0af7f0522d6d5e5c30bc8eb2795644e7d5970b161174cd0e94dfd4a400a795cf1429d998fcdae6ca32ad2532d8ef60213c66
-
SSDEEP
1536:KxIpVc8f8IgUGPMuwutNOZGsMz/4gqv40GUf:KipVcpIdjuXtNOnMEgb0
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/3044-13-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/3044-18-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/3044-9-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/3044-7-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/3044-15-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 2040 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exepid process 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exedescription pid process target process PID 1712 set thread context of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3068 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe9568c589eb240860758e5b783bc1d379_JaffaCakes118.exepowershell.exepid process 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 3044 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 3044 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 2040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe9568c589eb240860758e5b783bc1d379_JaffaCakes118.exepowershell.exedescription pid process Token: SeDebugPrivilege 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe Token: SeDebugPrivilege 3044 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe Token: SeDebugPrivilege 2040 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe9568c589eb240860758e5b783bc1d379_JaffaCakes118.exedescription pid process target process PID 1712 wrote to memory of 3068 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe timeout.exe PID 1712 wrote to memory of 3068 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe timeout.exe PID 1712 wrote to memory of 3068 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe timeout.exe PID 1712 wrote to memory of 3068 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe timeout.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 1712 wrote to memory of 3044 1712 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe PID 3044 wrote to memory of 2040 3044 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe powershell.exe PID 3044 wrote to memory of 2040 3044 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe powershell.exe PID 3044 wrote to memory of 2040 3044 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe powershell.exe PID 3044 wrote to memory of 2040 3044 9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 42⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\9568c589eb240860758e5b783bc1d379_JaffaCakes118.exe'3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1712-19-0x0000000074140000-0x000000007482E000-memory.dmpFilesize
6.9MB
-
memory/1712-1-0x0000000000CE0000-0x0000000000CF4000-memory.dmpFilesize
80KB
-
memory/1712-2-0x0000000074140000-0x000000007482E000-memory.dmpFilesize
6.9MB
-
memory/1712-3-0x0000000005890000-0x0000000005926000-memory.dmpFilesize
600KB
-
memory/1712-0-0x000000007414E000-0x000000007414F000-memory.dmpFilesize
4KB
-
memory/3044-20-0x0000000074140000-0x000000007482E000-memory.dmpFilesize
6.9MB
-
memory/3044-13-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3044-21-0x0000000074140000-0x000000007482E000-memory.dmpFilesize
6.9MB
-
memory/3044-6-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3044-18-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3044-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3044-9-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3044-7-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3044-15-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3044-5-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3044-22-0x0000000074140000-0x000000007482E000-memory.dmpFilesize
6.9MB