Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:33
Static task
static1
Behavioral task
behavioral1
Sample
59030a0053095636e952e6f479962248_JaffaCakes118.dll
Resource
win7-20231129-en
General
-
Target
59030a0053095636e952e6f479962248_JaffaCakes118.dll
-
Size
986KB
-
MD5
59030a0053095636e952e6f479962248
-
SHA1
d924fec422651094b1a45249a74672aed3b86f7b
-
SHA256
a983b4f3efef71b513a447fa124b681a89bdd34730546eb3947a6f9150e56bf1
-
SHA512
a17ec8fabff350d831a8c41b0c430d181cff3f95b11f8b8ea05983bea566c59127cadfa3301b944e43e3869cf491303b3e46807b8d4b25ce52bfb4ce173b98a6
-
SSDEEP
24576:OVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:OV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1372-5-0x0000000002A30000-0x0000000002A31000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
wscript.exepsr.exePresentationSettings.exepid process 2456 wscript.exe 2952 psr.exe 1904 PresentationSettings.exe -
Loads dropped DLL 8 IoCs
Processes:
wscript.exepsr.exePresentationSettings.exepid process 1372 1372 2456 wscript.exe 1372 2952 psr.exe 1372 1904 PresentationSettings.exe 1372 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Groztcac = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\4NOHrpN\\psr.exe" -
Processes:
rundll32.exewscript.exepsr.exePresentationSettings.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA psr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PresentationSettings.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 2960 rundll32.exe 2960 rundll32.exe 2960 rundll32.exe 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 1372 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
description pid process target process PID 1372 wrote to memory of 2684 1372 wscript.exe PID 1372 wrote to memory of 2684 1372 wscript.exe PID 1372 wrote to memory of 2684 1372 wscript.exe PID 1372 wrote to memory of 2456 1372 wscript.exe PID 1372 wrote to memory of 2456 1372 wscript.exe PID 1372 wrote to memory of 2456 1372 wscript.exe PID 1372 wrote to memory of 2484 1372 psr.exe PID 1372 wrote to memory of 2484 1372 psr.exe PID 1372 wrote to memory of 2484 1372 psr.exe PID 1372 wrote to memory of 2952 1372 psr.exe PID 1372 wrote to memory of 2952 1372 psr.exe PID 1372 wrote to memory of 2952 1372 psr.exe PID 1372 wrote to memory of 2500 1372 PresentationSettings.exe PID 1372 wrote to memory of 2500 1372 PresentationSettings.exe PID 1372 wrote to memory of 2500 1372 PresentationSettings.exe PID 1372 wrote to memory of 1904 1372 PresentationSettings.exe PID 1372 wrote to memory of 1904 1372 PresentationSettings.exe PID 1372 wrote to memory of 1904 1372 PresentationSettings.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59030a0053095636e952e6f479962248_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\0KW\wscript.exeC:\Users\Admin\AppData\Local\0KW\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\fVUsZkqK\psr.exeC:\Users\Admin\AppData\Local\fVUsZkqK\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\HnVZs1W\PresentationSettings.exeC:\Users\Admin\AppData\Local\HnVZs1W\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\0KW\VERSION.dllFilesize
987KB
MD58e4fbfc09522efacfd9ac4bf67d95261
SHA117234bd3de32f009c3074181a11af11e14e3b8b7
SHA25601e7dcc06759e2ce14f6ec0e1cff9ed0deff2e8ce4d305247c8a05d004f18e1f
SHA512d64f4c418ba307da1f28b1139898b1861246cf47468a21c3fda6f466ed1525505b563eb8be53bb9f0ed355ead4fc8526c9100c6637890c50b3a613b128b75c6f
-
C:\Users\Admin\AppData\Local\HnVZs1W\PresentationSettings.exeFilesize
172KB
MD5a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
C:\Users\Admin\AppData\Local\HnVZs1W\WINMM.dllFilesize
991KB
MD52bc550df9d0bcd598026148c5b186471
SHA199ae2aafb2639e9b2b781914401983ec76758c50
SHA2561405119c47eb82d71fb425ba42a38d3f676f900902b00d6219f7d916634bd99a
SHA512e2e571d4b70c05969563641897f862801c8bf782ded9517a242c1296fe9398411b993a961062f11d61356a9272e4a97e7d25519fa2d1e18e0d7d1e5f5fbd0394
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqrvnhd.lnkFilesize
971B
MD5dcbc566d59d56defb4a4a44e335370f3
SHA11d4471a08bdb489b20869a88a7a7f76d5c4a5217
SHA25604ee976c841da67c8ed3d382c7b6b38c4559e6132b523303e26192ac2cf040bc
SHA512eb0702076759c3f7f43b1872af0f2f7ba8f5bfe2fcf07c027bb7c36e6f47079efad02ca81d5f05dec931de50ad965d009cebd590c01be1bf22dfb99155306fcd
-
\Users\Admin\AppData\Local\0KW\wscript.exeFilesize
165KB
MD58886e0697b0a93c521f99099ef643450
SHA1851bd390bf559e702b8323062dbeb251d9f2f6f7
SHA256d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f
SHA512fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837
-
\Users\Admin\AppData\Local\fVUsZkqK\OLEACC.dllFilesize
987KB
MD564b8729f6bcfcde864140f773781263a
SHA172953c2da08a08dc8ad28d9ad4afecd3f2becc1f
SHA2560f1f212001be9eb45e67cbd0b9e7621888bb52da3230cde0dae0d9d1e81d8dba
SHA5125fa787ed777bff49cf4b34a7fe7d5742572f4ec39b8cb0ab16f1087870b74eab3018dcfe085aaa06cf9a4ca7b5bcc8f3d1182f9d613339020020f325e8776373
-
\Users\Admin\AppData\Local\fVUsZkqK\psr.exeFilesize
715KB
MD5a80527109d75cba125d940b007eea151
SHA1facf32a9ede6abfaa09368bfdfcfec8554107272
SHA25668910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495
SHA51277b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774
-
memory/1372-11-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-13-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-10-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-14-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-28-0x0000000077D70000-0x0000000077D72000-memory.dmpFilesize
8KB
-
memory/1372-27-0x0000000077BE1000-0x0000000077BE2000-memory.dmpFilesize
4KB
-
memory/1372-23-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-24-0x0000000002A10000-0x0000000002A17000-memory.dmpFilesize
28KB
-
memory/1372-9-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-37-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-35-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-4-0x0000000077AD6000-0x0000000077AD7000-memory.dmpFilesize
4KB
-
memory/1372-12-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-5-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/1372-76-0x0000000077AD6000-0x0000000077AD7000-memory.dmpFilesize
4KB
-
memory/1372-8-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1372-7-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/1904-92-0x0000000000390000-0x0000000000397000-memory.dmpFilesize
28KB
-
memory/1904-93-0x0000000140000000-0x00000001400FE000-memory.dmpFilesize
1016KB
-
memory/1904-98-0x0000000140000000-0x00000001400FE000-memory.dmpFilesize
1016KB
-
memory/2456-61-0x0000000140000000-0x00000001400FD000-memory.dmpFilesize
1012KB
-
memory/2456-56-0x0000000140000000-0x00000001400FD000-memory.dmpFilesize
1012KB
-
memory/2456-55-0x0000000001E80000-0x0000000001E87000-memory.dmpFilesize
28KB
-
memory/2952-77-0x0000000000710000-0x0000000000717000-memory.dmpFilesize
28KB
-
memory/2952-80-0x0000000140000000-0x00000001400FD000-memory.dmpFilesize
1012KB
-
memory/2960-0-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/2960-44-0x0000000140000000-0x00000001400FC000-memory.dmpFilesize
1008KB
-
memory/2960-3-0x00000000003A0000-0x00000000003A7000-memory.dmpFilesize
28KB