b157fd3064fc77b986f5333b9f0b898c5ea3677f1434fb8ca2369e18b43af166

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe
Size 1.2MB
Sample240507-yfrnhsfa32
SHA256 b157fd3064fc77b986f5333b9f0b898c5ea3677f1434fb8ca2369e18b43af166
MD5 21722a110bb1e6b58669826818f86cda
SHA1 314fb1740ce849295e5c34f71671cf631853872f
SHA512 4b30a12909ed2149e7a076d4b287d19b0fa012365decfe8aef989f330157d8505d1cd0e639127d1a977e8e3a361bd33300662a3ebb0edc8cc23dbd62e7180b5e
SSDEEP 24576:oDX2vzptbfKL1oX1Y5wrrRsrW7RdYxMn4iuKbQaqfQN+Qfsqo:QGvz5Xa0Nsr4Qx64qfqqB0qo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000146b8-50.dat	acprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014539-40.dat	upx
behavioral1/memory/2692-45-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-48-0x0000000010000000-0x000000001009F000-memory.dmp	upx
behavioral1/files/0x00060000000146b8-50.dat	upx
behavioral1/memory/2692-53-0x0000000010000000-0x000000001009F000-memory.dmp	upx
behavioral1/memory/2692-51-0x0000000010000000-0x000000001009F000-memory.dmp	upx
behavioral1/memory/2692-153-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-156-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-157-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-159-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-161-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-163-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-165-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-167-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-169-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-171-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-173-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-175-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-177-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-179-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral1/memory/2692-181-0x0000000000400000-0x0000000000553000-memory.dmp	upx

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Free Ride Games.exe
File opened (read-only)	\??\B:	Free Ride Games.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Free Ride Games.exe

Executes dropped EXE 13 IoCs

pid	Process
2692	Free Ride Games.exe
2528	cmhelper.exe
3036	cmhelper.exe
2076	cmhelper.exe
1084	cmhelper.exe
1664	cmhelper.exe
1988	cmhelper.exe
2016	cmhelper.exe
1752	cmhelper.exe
2512	cmhelper.exe
856	cmhelper.exe
1772	cmhelper.exe
2544	cmhelper.exe

Loads dropped DLL 18 IoCs

pid	Process
2296	21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe
2296	21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe
2296	21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
3036	cmhelper.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
1664	cmhelper.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
1752	cmhelper.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
1772	cmhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Free Ride Games.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Free Ride Games.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	Free Ride Games.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2692	Free Ride Games.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2692	Free Ride Games.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe
2692	Free Ride Games.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2692	2296	21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe	28
PID 2296 wrote to memory of 2692	2296	21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe	28
PID 2296 wrote to memory of 2692	2296	21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe	28
PID 2296 wrote to memory of 2692	2296	21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe	28
PID 2692 wrote to memory of 2528	2692	Free Ride Games.exe	29
PID 2692 wrote to memory of 2528	2692	Free Ride Games.exe	29
PID 2692 wrote to memory of 2528	2692	Free Ride Games.exe	29
PID 2692 wrote to memory of 2528	2692	Free Ride Games.exe	29
PID 3036 wrote to memory of 2076	3036	cmhelper.exe	31
PID 3036 wrote to memory of 2076	3036	cmhelper.exe	31
PID 3036 wrote to memory of 2076	3036	cmhelper.exe	31
PID 3036 wrote to memory of 2076	3036	cmhelper.exe	31
PID 2692 wrote to memory of 1084	2692	Free Ride Games.exe	32
PID 2692 wrote to memory of 1084	2692	Free Ride Games.exe	32
PID 2692 wrote to memory of 1084	2692	Free Ride Games.exe	32
PID 2692 wrote to memory of 1084	2692	Free Ride Games.exe	32
PID 1664 wrote to memory of 1988	1664	cmhelper.exe	34
PID 1664 wrote to memory of 1988	1664	cmhelper.exe	34
PID 1664 wrote to memory of 1988	1664	cmhelper.exe	34
PID 1664 wrote to memory of 1988	1664	cmhelper.exe	34
PID 2692 wrote to memory of 2016	2692	Free Ride Games.exe	35
PID 2692 wrote to memory of 2016	2692	Free Ride Games.exe	35
PID 2692 wrote to memory of 2016	2692	Free Ride Games.exe	35
PID 2692 wrote to memory of 2016	2692	Free Ride Games.exe	35
PID 1752 wrote to memory of 2512	1752	cmhelper.exe	37
PID 1752 wrote to memory of 2512	1752	cmhelper.exe	37
PID 1752 wrote to memory of 2512	1752	cmhelper.exe	37
PID 1752 wrote to memory of 2512	1752	cmhelper.exe	37
PID 2692 wrote to memory of 856	2692	Free Ride Games.exe	38
PID 2692 wrote to memory of 856	2692	Free Ride Games.exe	38
PID 2692 wrote to memory of 856	2692	Free Ride Games.exe	38
PID 2692 wrote to memory of 856	2692	Free Ride Games.exe	38
PID 1772 wrote to memory of 2544	1772	cmhelper.exe	40
PID 1772 wrote to memory of 2544	1772	cmhelper.exe	40
PID 1772 wrote to memory of 2544	1772	cmhelper.exe	40
PID 1772 wrote to memory of 2544	1772	cmhelper.exe	40

C:\Users\Admin\AppData\Local\Temp\21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21722a110bb1e6b58669826818f86cda_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
  "C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '681950' m 'playfincpa003' t '0' l 'Default'"
  2⤵
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPR
    3⤵
    - Executes dropped EXE
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPW
    3⤵
    - Executes dropped EXE
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPW
    3⤵
    - Executes dropped EXE
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPW
    3⤵
    - Executes dropped EXE
    PID:856

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  R
  2⤵
  - Executes dropped EXE
  PID:2076

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  W
  2⤵
  - Executes dropped EXE
  PID:1988

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  W
  2⤵
  - Executes dropped EXE
  PID:2512

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  W
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ietemp1.dat

Path C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat
Size 23B
SHA256 d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e
MD5 4174cb800274e3c271f7e53ae1b9ae35
SHA1 6ac0ca77eef3b68c8db3349f1ceb0c8083450642
SHA512 c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd
MD5 SHA1 SHA512

Submit Download

ietemp1.dat

Path C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat
Size 124B
SHA256 f5fcaa89ee08014f9319a7d732a534bfe1e044760818172684ab3cbec96e9b37
MD5 979ac5df0b591803a1dfe935dfedb908
SHA1 90deba6b414d3981ba0ae9d6133cfba02032d919
SHA512 3ca1eca8946d42acaf84cc6663225a7f550bc8e262d8ef63553c62382075210d948305aeb46c90861bbd6afd10e9247dcf187bba3aac2d0aa4034595fc276bfc
MD5 SHA1 SHA512

Submit Download

ietemp1.dat

Path C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat
Size 242B
SHA256 ef51904a0a127bc0dcc77ee52cd413f08c84364b5568c8d44fe1e8fecf15878e
MD5 f38e6a1c7339fc2820ae45c988674726
SHA1 df8adc71eb9b2672a2373dfed6d4e8a7055b0051
SHA512 404c73f9b14499cfa8540871f1aac0b6f5560440a441d53343a901c4aa1ac417cf8651bd1cccc893247609d4e28b732b824b6820cdd7c775470851a85972cd76
MD5 SHA1 SHA512

Submit Download

ietemp1.dat

Path C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat
Size 358B
SHA256 963a168dd6df4beeec4022eece9ca1e73c2d8cb10ceebcaf085741bad9298dc2
MD5 5df0ae316526d41f8eec4e6c0450ea6c
SHA1 250831a1550f466591c3899e55e4746ef527b5ea
SHA512 42e7102ede7e514240ba4fbabdc50ec8c65b810cdff2293d7b7f54abc6e71da713ec156648aed5e8276919b1f695806e519bf07acad01b8baeaecf5336eff8b3
MD5 SHA1 SHA512

Submit Download

WMB2K9MK.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WMB2K9MK.txt
Size 331B
SHA256 5f2f283b3b7a846f14e629b63c239aad0fa0ac2a3f40ef8e0b7f8e0aae462319
MD5 d9e52293ddcaa054066ef1cc59b68429
SHA1 5d6e4e33382e59d16f603b2dae14ad262e5ef7a2
SHA512 7ba3dc15056f08e5813440136465dd9df151ffd8fd99765126aae69ec57be9c1cb0e5e980ee497d3974e92ca23665e4a52ed1766c857a3b0315e6f3d5e413a89
MD5 SHA1 SHA512

Submit Download

Free Ride Games.exe

Path \Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
Size 504KB
SHA256 18f4519d20252bf579b887adec25554ac412bd79604547cca12f9f589549f952
MD5 23cad4075e1fd5d47c0434fef549efde
SHA1 d7cdc7cb933466474986ae37fc7ebefdad601aaf
SHA512 e4176411caac89db8dd073f2b47b7970168dacad4cdecc6edae310591e279149430b10ab1f956a7722ab22677ca893bfc4eb3fe17009b9b73a95e288c12c89b1
SSDEEP 12288:0obl5KiSHoYxGZ2YI7jjN3iR4S/RQq4jrY+vyRPZbN7yTMhHoSKU:/bzKLHoV1wpwxZRsrY7RJATMP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Splasher.dll

Path \Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll
Size 475KB
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7
SSDEEP 12288:2I2EL1NaycNyL+kNmQLnmQtMleiQ8Zceqw1:tTayPLDltMUiQ8Zceqw1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmhelper.exe

Path \Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
Size 234KB
SHA256 93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5
MD5 3a9774028e1e3968b8c202fd199d0084
SHA1 6e19763c3f42c8d6596135a7566bef07a0cbeadd
SHA512 ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06
SSDEEP 6144:VcF3h+/MWLriz/BaQKoiQH22uhJFJoaMOKFNgv5x48yH2geFELNtgxQh:VcF3h+By/BaQKoiQHa7oG/Fh0
MD5 SHA1 SHA512 SSDEEP

Submit Download

resourceDll.dll

Path \Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll
Size 171KB
SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25
SSDEEP 3072:+ZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vg/ySQGdXMd86a30GCooutkzjO:YWwqGaJfGZ1Mq5BRj2/yR8XMZ0CooSkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsyACB.tmp\System.dll
Size 11KB
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/856-97-0x0000000000280000-0x0000000000282000-memory.dmp

Download

memory/1084-75-0x0000000000240000-0x0000000000242000-memory.dmp

Download

memory/2016-86-0x00000000003E0000-0x00000000003E2000-memory.dmp

Download

memory/2296-155-0x00000000035A0000-0x00000000036F3000-memory.dmp

Download

memory/2296-44-0x00000000035A0000-0x00000000036F3000-memory.dmp

Download

memory/2528-65-0x0000000000480000-0x0000000000482000-memory.dmp

Download

memory/2692-51-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2692-163-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-48-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2692-153-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-45-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-156-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-157-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-159-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-161-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-53-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2692-165-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-167-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-169-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-171-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-173-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-175-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-177-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-179-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2692-181-0x0000000000400000-0x0000000000553000-memory.dmp

Download