d122d4beba16b9f42014e6f788b51cf1577d6c44518df92786e56987479661b3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8163c4bdb1eb9c1beb502bc194f8649_JaffaCakes118.exe
Size

160KB
MD5

f8163c4bdb1eb9c1beb502bc194f8649
SHA1

acc1bfc812bc832e5e82f5a4d4b7672e2e17ca5b
SHA256

d122d4beba16b9f42014e6f788b51cf1577d6c44518df92786e56987479661b3
SHA512

7e331446511499ef491813a017bff8a29d39c5a9f0ff6f1f688a4e106787fea69155703f1fdf8fdc12d57cfcc70a41c68eddf5f682a82f0fbbd70d6889ab062a
SSDEEP

1536:9/elR8Hruyv+mMiIAcI9vmQHv51skHMDnHbZAYsMKWqD7WCDYVRaJNGXp+B:F2WLuyv+mMi5cCeeM7FAJM3IymYVZo

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1764	attrib.exe
1808	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 552	2056	f8163c4bdb1eb9c1beb502bc194f8649_JaffaCakes118.exe	31
PID 2056 wrote to memory of 552	2056	f8163c4bdb1eb9c1beb502bc194f8649_JaffaCakes118.exe	31
PID 2056 wrote to memory of 552	2056	f8163c4bdb1eb9c1beb502bc194f8649_JaffaCakes118.exe	31
PID 2056 wrote to memory of 552	2056	f8163c4bdb1eb9c1beb502bc194f8649_JaffaCakes118.exe	31
PID 552 wrote to memory of 1408	552	cmd.exe	33
PID 552 wrote to memory of 1408	552	cmd.exe	33
PID 552 wrote to memory of 1408	552	cmd.exe	33
PID 552 wrote to memory of 1408	552	cmd.exe	33
PID 1408 wrote to memory of 856	1408	cmd.exe	35
PID 1408 wrote to memory of 856	1408	cmd.exe	35
PID 1408 wrote to memory of 856	1408	cmd.exe	35
PID 1408 wrote to memory of 856	1408	cmd.exe	35
PID 1408 wrote to memory of 1496	1408	cmd.exe	36
PID 1408 wrote to memory of 1496	1408	cmd.exe	36
PID 1408 wrote to memory of 1496	1408	cmd.exe	36
PID 1408 wrote to memory of 1496	1408	cmd.exe	36
PID 1408 wrote to memory of 1496	1408	cmd.exe	36
PID 1408 wrote to memory of 1496	1408	cmd.exe	36
PID 1408 wrote to memory of 1496	1408	cmd.exe	36
PID 1408 wrote to memory of 1492	1408	cmd.exe	37
PID 1408 wrote to memory of 1492	1408	cmd.exe	37
PID 1408 wrote to memory of 1492	1408	cmd.exe	37
PID 1408 wrote to memory of 1492	1408	cmd.exe	37

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1764	attrib.exe
1808	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f8163c4bdb1eb9c1beb502bc194f8649_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8163c4bdb1eb9c1beb502bc194f8649_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\s_Mg_l_219.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      PID:856
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:1156
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\1.inf
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\2.bat
      4⤵
      PID:1492
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        
        PID:1132
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        
        PID:2396
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
        5⤵
        
        PID:1556
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        
        PID:1724
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\redload\3.bat""" /f
        5⤵
        
        PID:1960
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1764
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1808
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\2.inf
        5⤵
        
        PID:700
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:2272
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:2252
- C:\Users\Admin\AppData\Local\Temp\inl6BCF.tmp
  C:\Users\Admin\AppData\Local\Temp\inl6BCF.tmp
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F8163C~1.EXE > nul
  2⤵
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
791B

MD5
1706b41fd446b5718a8419c0fcb35d55

SHA1
d9bb8df22acdc60c754ac14982cf795df3b1b815

SHA256
5c6d11ac3f220f8286455764ab2581dcb6554692d3b9974b097364d77edb3943

SHA512
68c9f6170ecdfcc79fc63cb646901d2ac52a915620b159047b2c93761c261897eb5ecc15065635105637a61a840d393104c15ea8268897fb8bb2fbc1a56c626e

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl6BCF.tmp

Filesize
2.6MB

MD5
6c297cf8f6b581bc73d333fd6c18a48b

SHA1
71fe38e4a848ef1a5e7c559550cb5e43d0083d53

SHA256
d07e174fcf300621e18098d2e350696eefdfe63fa24804a18b99f67d12f5d8b2

SHA512
2e0a5da7bace6266d1e62e2ddd1ee3538d122c290de044870dd0de885188adb8cea8f65708b5873ea762d4550910af17145d4e0487c4eb34181cb31bed097701

Download Submit
C:\Users\Admin\AppData\Local\Temp\inl6BCF.tmp

Filesize
2.5MB

MD5
944f65b16ca26b05052f1be6424a22bc

SHA1
fc2e618d83ca4407ecc3c44bb8edc627d29053a5

SHA256
d78684f86a694591cac7dfacb94d819449e0bc11b1febbcf31b47d97f0056f55

SHA512
26d4ecfa8c65ce1ceaa3bca025b06c4e93a083bea3e58782c70a5852dc02f8c2bedd6000722df7b300222598dbd0eeb349417de7436021c3c3750d097191e4ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\s_Mg_l_219.bat

Filesize
54B

MD5
504490369970f1c0eb580afbcdf91618

SHA1
b52f65cd538e6c998b2c7e3167f9c8e8fa6c7971

SHA256
a13a0579286521f0d7cb55fc7d28c6d33f14c0573e9e69f7584fa4008a8e7d43

SHA512
5495ce79abf0fc4ffbfaf9aefa484145f4e0d3e8457be0e2e4dfb1284fb5413016f2d9867e2386db5c4f7b51863bfffeae8ea6bd879053fdf6a928ab2a0857ad

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.bat

Filesize
3KB

MD5
168976102055ae6902b5d251d4b39401

SHA1
37c28d5b4d19bf3ef0be7be04ac4b54c71866773

SHA256
aabf9954046b451c6287c18b37448dbce289b0a76bb0bcbe72b7e97b6ebfc9fc

SHA512
95474e88ce99544ab19d25c3f96b348b99733858b8382baeedce62748444b529e55c0c4df84c20ff05eb7b3172baaa22ade7604c7288b536e1895cd95dbc42a6

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.bat

Filesize
3KB

MD5
428b15afd0f31b5f77d86f84a2e0bf36

SHA1
e76c640936f9ea1a4cf0f26e5417d4cbbde08ea2

SHA256
390a9eb07646fea162115045ea2b76a3a248d8823e7dc4a54851c39463ddfdb5

SHA512
3272917c8a65641eb39c280ba2f23c359145d8951ec78d803143fdbfa87cf6233a4d3a03607bcae7703f718dc592297aefc69726086a206e5d0bffd5655d8ca4

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.inf

Filesize
248B

MD5
2197ffb407fb3b2250045c084f73b70a

SHA1
3d0efbacba73ac5e8d77f0d25d63fc424511bcf6

SHA256
a1a42f5a41ce65135b1ad525eabc04cce89ee07d2f51d06e5e1dea6047081591

SHA512
b35a99e144da3f02de71158f58a6b937435d1bce941126a554783c667654b880527b11ba8a5c0fcf093ce28863ea4f5e60f73f8f973a727f177d584d2e9c80fe

Download Submit
C:\Users\Admin\AppData\Roaming\redload\4.bat

Filesize
9.1MB

MD5
8300cb409d6d7872ad8093140777109e

SHA1
553f4f39616207492c07eb53d6a5a2bbe93f8abf

SHA256
6ff92d4651d9d5bd57329b82a8e301aa7a05e9d949067dff8db1b12c56fbcbca

SHA512
2e3b2c93e211b401e7a0413e6dd29b2804039462b99d842a13a4849a86b8a8fac796f340d492a74847909730224f82ea879abab6bb5a763d1fa3df8085812cc2

Download Submit
\Users\Admin\AppData\Local\Temp\inl6BCF.tmp

Filesize
1.9MB

MD5
e9e2e43f01e903ee3f3ad6276eebf306

SHA1
b59c23fb7b905357c498e16533768412b5e6e4d8

SHA256
b8c1b9ddb3add82b56547fbf28f361cedc663dd7fe8bdc6a83963d74d4d578d5

SHA512
ba8f4214c3136a80c29ed2970a339c54d50d45a6218afed1ac099b835cdef079330eb53516ea77c11a83a1a9e585d16979f07d66d4af1c6f09047326d176e245

Download Submit
\Users\Admin\AppData\Local\Temp\inl6BCF.tmp

Filesize
2.6MB

MD5
5dd67bcf883ee095f2cd6b2874f76f58

SHA1
9fb31d417ff1d8dae729121128b503627f4daa23

SHA256
8ea94cd9bb3bd3966220d21e946d2f893d4454f5d181c3cd0bd4fc8849bc8ddf

SHA512
fb6a4955d71ae98031bb5b78300eabd6af19618063d4d3563628f628d5d3d8657e117664d0aef53ef579638f432357d25bd45c7e96c4aa60d51b4370965c8f43

Download Submit
memory/856-58-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Filesize
64KB

Download
memory/2056-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads