Overview
overview
10Static
static
30afc9b07d4...18.exe
windows7-x64
100afc9b07d4...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3class.noobSlide.js
windows7-x64
1class.noobSlide.js
windows10-2004-x64
1exit.jsp15...8.html
windows7-x64
1exit.jsp15...8.html
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-05-2024 03:14
Static task
static1
Behavioral task
behavioral1
Sample
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
class.noobSlide.js
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
class.noobSlide.js
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
exit.jsp1550152078.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
exit.jsp1550152078.html
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
uninst.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
General
-
Target
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe
-
Size
282KB
-
MD5
0afc9b07d41ebdabc1d23559452d07d3
-
SHA1
a48c8c48f446835cb3a2522180223a3a9fe5349d
-
SHA256
ac349ddf5d93a43f30ab2566ea00404e017a87b5c715f2b258624e5e488d16ea
-
SHA512
1f87126b326954cc01a98c6469c6204f6b2f85d41c0217ef835b311a7674ecf0d075fe47a63131cd183a6fc1a37ee289ecae8edad3ca5f52bce72757103370e9
-
SSDEEP
6144:tGC7W7BUagKatVsWNMV+qUCp9GwmZFT254EyLvYsoKDLZKDEACZMH:/a7fgt6MK/GwmTa+LwsoyoEACyH
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\_README_2CK9TM_.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (576) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 948 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exepid process 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6C79.bmp" 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exedescription pid process target process PID 1412 set thread context of 2528 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_README_VGSM_.hta 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1320 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exepid process 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exepid process 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeShutdownPrivilege 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe Token: 33 1192 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1192 AUDIODG.EXE Token: 33 1192 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1192 AUDIODG.EXE Token: SeDebugPrivilege 1320 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.execmd.exedescription pid process target process PID 1412 wrote to memory of 2528 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe PID 1412 wrote to memory of 2528 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe PID 1412 wrote to memory of 2528 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe PID 1412 wrote to memory of 2528 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe PID 1412 wrote to memory of 2528 1412 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe PID 2528 wrote to memory of 2664 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe mshta.exe PID 2528 wrote to memory of 2664 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe mshta.exe PID 2528 wrote to memory of 2664 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe mshta.exe PID 2528 wrote to memory of 2664 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe mshta.exe PID 2528 wrote to memory of 948 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe cmd.exe PID 2528 wrote to memory of 948 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe cmd.exe PID 2528 wrote to memory of 948 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe cmd.exe PID 2528 wrote to memory of 948 2528 0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe cmd.exe PID 948 wrote to memory of 1320 948 cmd.exe taskkill.exe PID 948 wrote to memory of 1320 948 cmd.exe taskkill.exe PID 948 wrote to memory of 1320 948 cmd.exe taskkill.exe PID 948 wrote to memory of 1056 948 cmd.exe PING.EXE PID 948 wrote to memory of 1056 948 cmd.exe PING.EXE PID 948 wrote to memory of 1056 948 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\_README_1GNI_.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "0afc9b07d41ebdabc1d23559452d07d3_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5081⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\_README_2CK9TM_.htaFilesize
66KB
MD5005eba7df5eafa5228e6d1e21590fbbc
SHA18cb0debb5307bb243ff5002013f1dd7b817ad64a
SHA256e4d2b40de8cd4a114b3b32ab11154833dc9e6ba4aaa87124634df845112a7e34
SHA5126dfc10877b3c550e6f9f270ad747d44f7cc69a93dfe6cf00833a499f9db7647225d2581583f84a6040252de2106fdf575f80825dc2bccbb53537452f2f611d4f
-
\Users\Admin\AppData\Local\Temp\nsyB03D.tmp\System.dllFilesize
11KB
MD53e6bf00b3ac976122f982ae2aadb1c51
SHA1caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA2564ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
SHA5121286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
memory/1412-17-0x0000000000340000-0x000000000036C000-memory.dmpFilesize
176KB
-
memory/1412-12-0x0000000000340000-0x000000000036C000-memory.dmpFilesize
176KB
-
memory/2528-44-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-25-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-19-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-24-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-26-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-42-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-16-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-18-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-14-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-117-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-330-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-334-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-340-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-357-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-364-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2528-370-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB