Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
16/04/2024, 00:42
Behavioral task
behavioral1
Sample
f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe
- Size 19KB
- Sample240416-a2v13aef3z
- SHA256 9103ccb66b12848c3bd27a2196e1f43b37002f0500298881809536dbc392ddc2
- MD5 f24b74a68f4a55bcb57dd4d6d0152ced
- SHA1 c27bc7b977265245399a9e74ca8114dbd0967979
- SHA512 594a45d126d118f042d09db4dd58011e9208686cde2b26d985ee83b9c4d82b4116ae1ecd929c74c331fd6ca19037db1b9bb0cc5d9b45d87d107ebd5dd1d42f93
- SSDEEP 384:koRIiC3cL0yGxrACcKAW8BFyPmjvy0la0I54pKYTAA/91ZuaNJawcudoD7UJ:BIilTGxUC998jRrI+KYB5nbcuyD7U
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x001c00000001e97e-2.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 3892 sbsm.exe - Loads dropped DLL 1 IoCs
pid Process 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2860-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/files/0x001c00000001e97e-2.dat upx behavioral2/memory/2860-10-0x0000000000400000-0x000000000040E000-memory.dmp upx - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\ f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.newsearchgate.com/index.php?b=1&t=0&q={searchTerms}" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.browsergate.com/redirect.php" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\Search f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\Main f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\SearchScopes f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\xxx = "xxx" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32\ThreadingModel = "Apartment" f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 3892 sbsm.exe 3892 sbsm.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2860 wrote to memory of 3892 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 88 PID 2860 wrote to memory of 3892 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 88 PID 2860 wrote to memory of 3892 2860 f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f24b74a68f4a55bcb57dd4d6d0152ced_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\sbmdl.dll
- Size 9KB
- SHA256 ccb79c374b508eb9958246cc4001bc071deb6cbe5200bdd1687ac9891d134bc3
- MD5 744f2525e13099f5234d6497abb584a7
- SHA1 00d39c525842aa88c59cef9cb2bdd012be6f52d6
- SHA512 378ba7fdf87963f48b89f16e12237c96aa8fae083d324eff7671531b6bb07f6b4660ca78c955fb05e24ed4e136d44240d9848ec5ba60d784d483710753492fb5
- SSDEEP 192:QWY6YCTSukW5g7N6Q4qCFmgFFZhbaFaNJhLkwcud2DH9VwGfctfXb:QvsS8INlCQeZhb+aNJawcudoD7Ul
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\sbsm.exe
- Size 7KB
- SHA256 91f2feb9a206fa5d08c8bbb7712a5eb79015d26b3346d6d185107096fc8f8c83
- MD5 3b92afcf8d7f388bdda02cf37621b828
- SHA1 621ee1b314797ddcb138643f7c68fd52ba607568
- SHA512 0f731334582c602c99b178003cbe96a2c0599968d8ee6fef35409cd5d130219c8173382d49d1907e1e2b43adc12dad487efe92f7c51c02526690b8994f5a2ad9
- SSDEEP 192:9DMSsu5Z5syGwovKSGf+CB0jryVlIV+/v8i:9ISbvsySKinr0IV+v9
- MD5 SHA1 SHA512 SSDEEP