Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-04-2024 01:07
Behavioral task
behavioral1
Sample
ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe
-
Size
45KB
-
MD5
ec5e7e3130e74b990c0be814058118bf
-
SHA1
7e735e485321f9260007b1fe86b81ad514374987
-
SHA256
b38a4554e2730f5a5b5d42d277908de268e2a1b7297347296e34fdecbaa81d0d
-
SHA512
a03111c766d4c00560b1b4b635c57f6c05a704dc44c30f86315a1894c57a8e4c0852fc4f05a85184eb682fbea81ec9239098384ea569835800a26f93f5194ad4
-
SSDEEP
768:Y1QNQMBO3Mqe9KZb0LB+8vGMRXyonbcuyD7UURfUJLJAnbcuyD7U:aQGeO3MB9KeY8vGMRXfnouy8z4nouy8
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000012254-2.dat acprotect behavioral1/memory/2956-4-0x0000000010000000-0x000000001000A000-memory.dmp acprotect -
Executes dropped EXE 1 IoCs
pid Process 2632 sbsm.exe -
Loads dropped DLL 3 IoCs
pid Process 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2956-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/files/0x0008000000012254-2.dat upx behavioral1/memory/2956-4-0x0000000010000000-0x000000001000A000-memory.dmp upx behavioral1/memory/2956-13-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/2956-14-0x0000000010000000-0x000000001000A000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\ ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7} ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Search ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.iefixgate.com/redirect.php" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchinggate.com/index.php?b=1&t=0&q={searchTerms}" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7} ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\xxx = "xxx" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32\ThreadingModel = "Apartment" ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 2632 sbsm.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2632 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 28 PID 2956 wrote to memory of 2632 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 28 PID 2956 wrote to memory of 2632 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 28 PID 2956 wrote to memory of 2632 2956 ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec5e7e3130e74b990c0be814058118bf_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d8722caacb60c2c3405320541dcd9242
SHA1438fa00ccfc621ac59094ad5037c823ebbe1be53
SHA2569bb01dcf2caea54ed2506d90b44dbafb75d436c5e1ec10540d60abace87601bf
SHA5129387a62278a8c9e4bbbc737956800447a7609f043b84974a57f63e427816e6736f16c3dd8150b564a386331f00917e83f78ded4e98f932e19c4caac1842ae489
-
Filesize
5KB
MD5fe1e8993dbb83d60527b486a462392f5
SHA1d08dac8a5bd208a73a5cc2053a15103ce6f46fd8
SHA256284db6666091c2922d05651e46057a8960bd3e555e9f1a9ab623ad771aebf4f6
SHA5122fc991dbca9a3f0db7a0b5d18c4045165ed345984c0f67801be4124455b33b5498968311044897910cd80dd6ad33dad2e4face3af0ca795d6be883c1be31fa89