Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 21:13
Behavioral task
behavioral1
Sample
fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe
-
Size
17KB
-
MD5
fb2dcc045afd144b1b743efbed7b60ce
-
SHA1
b0eb38604c9e5065f10cf35ffc8b88899c054567
-
SHA256
4c5d464d2636c4e155fa51be824cbf2038824683c7778738d59dee5a2cd8ab69
-
SHA512
3e025b8132d6457084c57267d08722c9945ec7bab4d336b9d62c23986fe104f28dcc133023b9fd7629100ae76a8b636369a2ab02cc5cf030af0beee12d9b3086
-
SSDEEP
384:GtBXPIffR9PaRGeRcm+WiPMDQ2Q8+Wdvm8Gzg10jds:0x+vaNcXPcd+8ugyR
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts alg.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H8I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "safeint" alg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H8I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%windir%\\Tasks\\killbase.vbs" alg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H8I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK} alg.exe -
Deletes itself 1 IoCs
pid Process 2900 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2620 alg.exe -
Loads dropped DLL 2 IoCs
pid Process 2900 cmd.exe 2900 cmd.exe -
resource yara_rule behavioral1/memory/1976-0-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/1976-9-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/files/0x000d000000012253-12.dat upx behavioral1/memory/2900-13-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/2620-57-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/2620-283-0x0000000000400000-0x0000000000411000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run alg.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: alg.exe File opened (read-only) \??\E: alg.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\wincap.exe alg.exe File created C:\Windows\SysWOW64\arps.com alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\wsock32.dll alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\wsock32.dll alg.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\wsock32.dll alg.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\wsock32.dll alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\wsock32.dll alg.exe File created C:\Program Files\Google\wsock32.dll alg.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\wsock32.dll alg.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\wsock32.dll alg.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\wsock32.dll alg.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\wsock32.dll alg.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\ja-JP\wsock32.dll alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\wsock32.dll alg.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\wsock32.dll alg.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\wsock32.dll alg.exe File created C:\Program Files\DVD Maker\en-US\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\wsock32.dll alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\wsock32.dll alg.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\wsock32.dll alg.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\wsock32.dll alg.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\wsock32.dll alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\wsock32.dll alg.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\wsock32.dll alg.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\wsock32.dll alg.exe File created C:\Program Files\Java\jre7\lib\zi\wsock32.dll alg.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\wsock32.dll alg.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\wsock32.dll alg.exe File created C:\Program Files\Java\jre7\lib\management\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\wsock32.dll alg.exe File created C:\Program Files\Common Files\System\fr-FR\wsock32.dll alg.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jre7\lib\applet\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\wsock32.dll alg.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\wsock32.dll alg.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\wsock32.dll alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\wsock32.dll alg.exe File created C:\Program Files\Microsoft Games\Solitaire\wsock32.dll alg.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\wsock32.dll alg.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\wsock32.dll alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\wsock32.dll alg.exe File created C:\Program Files\VideoLAN\VLC\locale\km\wsock32.dll alg.exe File created C:\Program Files\Microsoft Office\Office14\wsock32.dll alg.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\wsock32.dll alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\wsock32.dll alg.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\wsock32.dll alg.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\wsock32.dll alg.exe File created C:\Program Files\Java\jre7\lib\images\cursors\wsock32.dll alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\wsock32.dll alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\wsock32.dll alg.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\wsock32.dll alg.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\wsock32.dll alg.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\wsock32.dll alg.exe File created C:\Program Files\Common Files\SpeechEngines\wsock32.dll alg.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\wsock32.dll alg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\wsock32.dll alg.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\mfxixue.ini alg.exe File created C:\Windows\Tasks\alg.exe fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe File created C:\Windows\Tasks\killbase.vbs alg.exe File opened for modification C:\Windows\Tasks\killbase.vbs alg.exe File created C:\Windows\Tasks\ÂÌ»¯.bat alg.exe File opened for modification C:\Windows\Tasks\ÂÌ»¯.bat alg.exe File created C:\Windows\Tasks\wsock32.dll alg.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2564 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe 2620 alg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2620 alg.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2900 1976 fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe 28 PID 1976 wrote to memory of 2900 1976 fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe 28 PID 1976 wrote to memory of 2900 1976 fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe 28 PID 1976 wrote to memory of 2900 1976 fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe 28 PID 2900 wrote to memory of 2564 2900 cmd.exe 30 PID 2900 wrote to memory of 2564 2900 cmd.exe 30 PID 2900 wrote to memory of 2564 2900 cmd.exe 30 PID 2900 wrote to memory of 2564 2900 cmd.exe 30 PID 2900 wrote to memory of 2620 2900 cmd.exe 31 PID 2900 wrote to memory of 2620 2900 cmd.exe 31 PID 2900 wrote to memory of 2620 2900 cmd.exe 31 PID 2900 wrote to memory of 2620 2900 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.execmd /c c:\mfxixue.bat2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\ipconfig.exeipconfig3⤵
- Gathers network information
PID:2564
-
-
C:\Windows\Tasks\alg.exeC:\Windows\Tasks\alg.exe3⤵
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD52565f1bfc8bd5e2a7f9c2c508635043a
SHA11204962603032e780240d15b24c52752ac4b1826
SHA2564a1351fffeb0ba8f4aafb0958b1451124d84184f24c8742934e49ae5a43cae85
SHA5127a6ad0446637a109241a5c0a93cf12b6d19c4f7fb328bb153f7b4c43c9d54a97ea27b2b69173eb778b43a2f5c0edcc782d8ad0f74827e2291ba1a5692695ff61
-
Filesize
912B
MD548ec95bacc8186d72cce11b9584faeb7
SHA10a6900de60be125b545d36a55f56bd0f7db18d32
SHA256402d34fd239a2ecdc35929964d2ba2b8094fc601cee519955734994c67d3d79c
SHA51242115db0a178b8ff4f80d932b1c716724f52159c9e00cab154c6b984bbc1a726947c560cf74821a49876b7d9fa491791e5a5ce5a6e3545ee6fd7c5a0bfc6873d
-
Filesize
17KB
MD56c9b20460dac897528114c7d843bb93b
SHA187ffd916d3f781417fffecd9f433409e56c94c6a
SHA2562c399cee34cc1fb1d220018992ad10d11c2c9f02fdff1babf75870726665ebb7
SHA51227ada1702a58cd1f3cb0c1b66ca7efd3807276a1e42bfb346b2765e8c3b294a8caafa48255bf8fa0d04d39d1e8d3127504e8f44c9a868c78240958ce3385470c
-
Filesize
95B
MD5b0e06ce37bba9450fb0241614a517141
SHA1ab74f193a28e6a6eb75f171eb48e6d00f2015de3
SHA256d19dd95ddd530c1e654f4c2b79829f5ac4b4321e94e08198b0cba7f2d9df9401
SHA512c457bddc7c64cd8a20c6614180fba70f46f27b1c7d6229ab300e3755c5ca34e5da9b1822445e66658d8d73d124dbb6f6ed4f34f423f4bafd6f8a80f4481f99fc
-
Filesize
17KB
MD5bb27a68ebe877eba5dbbce06d131ee6a
SHA1f4fc6b39338922d258012e8404a9cb56d8e4c846
SHA2568821fa495a8d553eb91e0e346990e6fd422f099baa79a01be6975fc18659a669
SHA5120424c004d43b4e4b7b88546d7f45b6cf03247bb2b6de8a50a77f35ec5ccd29f4be61d312ebca92ef6e9486e44f6e67080ffd218788a01e0526a58bb76c1a61ea
-
Filesize
143B
MD57799ae90e02ff5feede2bd319919e6ff
SHA1384ea24428cf4931d9876fc7619db3cc08747c3f
SHA256cdabaa0483269e242e0bed8c3bfccfd3313ed9fd411dbed3405d653e4a1a5d96
SHA512f47ebf984d18bf5d0a5ba468bd256d4dfb41e707f71d40ca541cce4206bf64ed0afee57b800f1931e1db685abc7ca2249107523ddd08fde60c853c59f0ba221a