Overview
overview
7Static
static
3e355481093...18.exe
windows7-x64
7e355481093...18.exe
windows10-2004-x64
7$PLUGINSDI...ig.dll
windows7-x64
3$PLUGINSDI...ig.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3IETab.dll
windows7-x64
6IETab.dll
windows10-2004-x64
6IETab.exe
windows7-x64
6IETab.exe
windows10-2004-x64
6IETabHelper.dll
windows7-x64
1IETabHelper.dll
windows10-2004-x64
1Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
06/04/2024, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
IETab.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
IETab.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
IETab.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral14
Sample
IETab.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
IETabHelper.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral16
Sample
IETabHelper.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe
- Size 330KB
- Sample240406-1d2rtabe7y
- SHA256 5f0eb604489fccc60a72467d3dc77a2d8bf20af82935d425f2a470fd6cb7f014
- MD5 e3554810937d8b4439be8a247dcad002
- SHA1 03f8302c85dcc8a5e1d5a6199995d68735eceda2
- SHA512 73cbf5f3a37e8b6adca5fd349d028a1003f5fb2228c6349edc82d682d278a60279202c11a4044a2a9646be34f0ead1dea1f6cd4cc18943d89414952f28b990be
- SSDEEP 6144:Je34xvY75+ZPPfnE2Qyn20UT/bylyARbhHYVJvy8M9uM75+ZPPfnE2Qyn20U9:BgF+ZPPfnEUnJykkJvyD4MF+ZPPfnEU2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe - Deletes itself 1 IoCs
pid Process 2984 IETab.exe - Executes dropped EXE 1 IoCs
pid Process 2984 IETab.exe - Loads dropped DLL 8 IoCs
pid Process 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IETab = "\"C:\\Program Files (x86)\\IETab\\IETab.exe\"" e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IETab = "C:\\Program Files (x86)\\IETab\\IETab.exe" IETab.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\IETab\Uninstall.exe e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe File created C:\Program Files (x86)\IETab\IETabHelper.dll e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe File created C:\Program Files (x86)\IETab\IETab.exe e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 2984 IETab.exe 2984 IETab.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 IETab.exe 2984 IETab.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1700 wrote to memory of 5004 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 87 PID 1700 wrote to memory of 5004 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 87 PID 1700 wrote to memory of 5004 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 87 PID 1700 wrote to memory of 2856 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 89 PID 1700 wrote to memory of 2856 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 89 PID 1700 wrote to memory of 2856 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 89 PID 1700 wrote to memory of 4012 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 90 PID 1700 wrote to memory of 4012 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 90 PID 1700 wrote to memory of 4012 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 90 PID 1700 wrote to memory of 2984 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 92 PID 1700 wrote to memory of 2984 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 92 PID 1700 wrote to memory of 2984 1700 e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe 92 PID 2984 wrote to memory of 5024 2984 IETab.exe 94 PID 2984 wrote to memory of 5024 2984 IETab.exe 94 PID 2984 wrote to memory of 5024 2984 IETab.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e3554810937d8b4439be8a247dcad002_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\WallTab\WallTab.dll"2⤵PID:5004
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\SideTab\SideTab.dll"2⤵PID:2856
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\PostTip\PostTip.dll"2⤵PID:4012
-
-
C:\Program Files (x86)\IETab\IETab.exe"C:\Program Files (x86)\IETab\IETab.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\IETab\IETab.dll"3⤵PID:5024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\IETab\IETab.exe
- Size 126KB
- SHA256 e99d960ce333b2d0d8675b9eddf788f1c5d9b630afa38c12566ffbd067c5d1cc
- MD5 0e32aac391e0c398e3d190cba5a78b76
- SHA1 87a55a05bfff84454fa4d616686d92c0fcae2bda
- SHA512 c24ff351f7681915db3ad658b5b5161ed2848dde487cde1cbc1e8d337a715557bb6d06fd0ff84e5b77e5ac728737f0f21c5f5a6989b2f5b294248e2b730dea4e
- SSDEEP 1536:WidDeqtj00TZEW6ro5dA0IN/HxLklbUEyX/ALJIUVKM9pWrMnnPz7XGPs:WiEqr6c50N/HwbUZX/Yjf9pFnPz7XGE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsh3384.tmp\IpConfig.dll
- Size 114KB
- SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
- MD5 a3ed6f7ea493b9644125d494fbf9a1e6
- SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
- SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
- SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsh3384.tmp\NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsh3384.tmp\UAC.dll
- Size 13KB
- SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
- MD5 431e5b960aa15af5d153bae6ba6b7e87
- SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
- SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
- SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsh3384.tmp\nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- MD5 SHA1 SHA512