104075a9d32f48cf8f38bf1d4f167677956353025742cf44ea1333277510a08b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
Size

4.4MB
MD5

16e28a3d1acd75a0c572ecca2d700091
SHA1

813a8a568bc0f70f0445984d9477d5dcdb691ac9
SHA256

104075a9d32f48cf8f38bf1d4f167677956353025742cf44ea1333277510a08b
SHA512

fc241a6f6d6c33a81ec655b3b5b6fe3d22e92e69dfa163438a522a6cd35415e1d37ba50a0c0537f8a93dedae56f7515cff3cfab96e1da8f6861303bd085397d8
SSDEEP

98304:wzz+XKNcftkb40z9LaIjA9yHtynfDFe2uNgto5ibfdPWjm:w+S4jEyfDSYR2m

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETA3AF.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SETA3AF.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\EsgScanner.sys	rundll32.exe

Executes dropped EXE 2 IoCs

pid	Process
1764	EsgInstallerx64Stub.exe
852	EsgInstallerDelay_1e71bbf294f07658c4881bd2b4e979dc_0.exe

Loads dropped DLL 11 IoCs

pid	Process
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
2228	Process not Found
1404	Process not Found
1404	Process not Found
1404	Process not Found
1404	Process not Found
1404	Process not Found
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
904	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 1 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\license.txt	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Italian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Common.dll	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.inf	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Norwegian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.com	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\ShScanner.dll	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Danish.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Dutch.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Slovene.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\defs\def.dat	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\ExecutionGuard.dll	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Indonesian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Polish.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File opened for modification	C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.com	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\English.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Lithuanian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Spanish.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Swedish.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Greek.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\purl.dat	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.sys	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\German.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Russian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Chinese(Simplified).lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Croatian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Romanian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Defman.dll	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\native.exe	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\French.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Portuguese.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Brazilian.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Japanese.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Czech.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Finnish.lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
File created	C:\Program Files\Enigma Software Group\SpyHunter\Chinese(Traditional).lng	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
596	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
Token: SeBackupPrivilege	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
Token: SeRestorePrivilege	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
Token: SeDebugPrivilege	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1644	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	28
PID 1472 wrote to memory of 1644	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	28
PID 1472 wrote to memory of 1644	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	28
PID 1472 wrote to memory of 1644	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	28
PID 1472 wrote to memory of 1764	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	30
PID 1472 wrote to memory of 1764	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	30
PID 1472 wrote to memory of 1764	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	30
PID 1472 wrote to memory of 1764	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	30
PID 1764 wrote to memory of 2844	1764	EsgInstallerx64Stub.exe	32
PID 1764 wrote to memory of 2844	1764	EsgInstallerx64Stub.exe	32
PID 1764 wrote to memory of 2844	1764	EsgInstallerx64Stub.exe	32
PID 2844 wrote to memory of 1880	2844	rundll32.exe	33
PID 2844 wrote to memory of 1880	2844	rundll32.exe	33
PID 2844 wrote to memory of 1880	2844	rundll32.exe	33
PID 1880 wrote to memory of 1652	1880	runonce.exe	34
PID 1880 wrote to memory of 1652	1880	runonce.exe	34
PID 1880 wrote to memory of 1652	1880	runonce.exe	34
PID 1472 wrote to memory of 596	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	35
PID 1472 wrote to memory of 596	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	35
PID 1472 wrote to memory of 596	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	35
PID 1472 wrote to memory of 596	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	35
PID 1472 wrote to memory of 852	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	38
PID 1472 wrote to memory of 852	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	38
PID 1472 wrote to memory of 852	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	38
PID 1472 wrote to memory of 852	1472	16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16e28a3d1acd75a0c572ecca2d700091_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /tn SpyHunter4Startup /rl highest /sc ONLOGON /tr "\"C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe\" /s" /f
  2⤵
  - Creates scheduled task(s)
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\EsgInstallerx64Stub.exe
  C:\Users\Admin\AppData\Local\Temp\EsgInstallerx64Stub.exe -inf DefaultInstall -if "C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.inf" -wait -1
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 132 C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.inf
    3⤵
    - Drops file in Drivers directory
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:1652
- C:\Windows\System32\sc.exe
  C:\Windows\System32\sc.exe create "SpyHunter 4 Service" binPath= "\"C:\Program Files\Enigma Software Group\SpyHunter\Sh4Service.exe\"" DisplayName= "SpyHunter4 Service" start= auto
  2⤵
  - Launches sc.exe
  PID:596
- C:\Users\Admin\AppData\Local\Temp\EsgInstallerDelay_1e71bbf294f07658c4881bd2b4e979dc_0.exe
  C:\Users\Admin\AppData\Local\Temp\EsgInstallerDelay_1e71bbf294f07658c4881bd2b4e979dc_0.exe -exec CV4P+xygvPOFO/dCO2afl9/Gv0h/j7gpYm2O1knUWcBdGKgfSuDvRodBjRP7CVV4wTwHsG7aBWO7Qbn/v2X3Pg== -args yxLBkkwK+tN/g/lTFU7okMk01a8t+L6jhnEHJZP5MeU= -wait 300
  2⤵
  - Executes dropped EXE
  PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Enigma Software Group\SpyHunter\EsgScanner.inf

Filesize
1KB

MD5
b502b976d57fe85434ac93528ac27b05

SHA1
1bdf21314ff4d161e608067acbb6407e33c2edc3

SHA256
3b83918e5c5f069885b5be95d89fad6d964aec68a70f8717bcbee88f7fca177e

SHA512
e1bb2a1d236fd895dc0966c08a664fccf4c5794d7f07ea9b6fa77b0ad7a0bb42e1eb43aa0ba07f3b63f789c1939fa15266b3b830726924c4f39fee2fd2b9f891

Download Submit
C:\Windows\System32\drivers\SETA3AF.tmp

Filesize
22KB

MD5
3b32caa07d672f8a2e0df5cb3a873f45

SHA1
d61c97fe35649c01280291dda96e6b0df74da492

SHA256
09687e30fa5779c3593769d66caebed95c932746edd6e83dabe3dcfd126ab5ec

SHA512
1ac0e91eff28a7587acc2ab73cd8b513260acdc2e53b9531f4cabb2b92a1d487ed42edb24c5c6319b2e467c98ccb8697d51653c4cadcb27a256249e2bb48aace

Download Submit
\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe

Filesize
9.6MB

MD5
3762cdf8e0c1429c47028679dd2bbf89

SHA1
fc6b12ddda4e52f21c65ca748dd26e01be193e98

SHA256
e8a33d753a0804a335f1ef49588c7e5433f18f4926464a00bea27ce9344c6c3b

SHA512
9a9ceb887139610202d440926ad4a974508936d3d7a81e6ab6936b3582aced806b76e0fa2e39e243379254a1f236fda2dd5d0f144e4516d4d74371be30ccbe7b

Download Submit
\Users\Admin\AppData\Local\Temp\EsgInstallerDelay_1e71bbf294f07658c4881bd2b4e979dc_0.exe

Filesize
215KB

MD5
19b67ab7591a2dc79ccf9ec2160e3c4c

SHA1
5f6716a8772fc8b36d37f1829031edd9062f36a2

SHA256
a59ad588e91e7d40ad57af3aa41d32341c1c6cf2e2eff614802f103b67941595

SHA512
75795c10aa25b0fb9c2a07fec4e73a457b0956aef95587303b49ed0a9422f1c22637fc80439adc1798fd9a728107fc6854634cfd0d6e5ea98309cbf8ad6a806c

Download Submit
\Users\Admin\AppData\Local\Temp\EsgInstallerx64Stub.exe

Filesize
156KB

MD5
3aa22e5e51d9a1d0bf0975d08f9f0c0d

SHA1
e8af46664bb81ccae93a2fa65889f820c76d016a

SHA256
e905047af9613f9122ad0585c5845dd87a375616eb13ebb61b7f5ac5b6503618

SHA512
a8c5ec9512ceb4c9a34656366ad284558cf6382bcaa792a73dc41687e6aa9c88d23296d768fa7d0918bdd280ba463e3b031b80cf71cb57d6acb9fab8266a5f4b

Download Submit
memory/1472-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1472-24-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download