Overview

overview

8

Static

static

3

5e94109129...18.exe

windows7-x64

8

5e94109129...18.exe

windows10-2004-x64

8

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows7-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PROGRAMFI...4D.exe

windows7-x64

1

$PROGRAMFI...4D.exe

windows10-2004-x64

1

$PROGRAMFI...rv.exe

windows7-x64

1

$PROGRAMFI...rv.exe

windows10-2004-x64

1

$PROGRAMFI...n.html

windows7-x64

1

$PROGRAMFI...n.html

windows10-2004-x64

1

$PROGRAMFI...ack.js

windows7-x64

3

$PROGRAMFI...ack.js

windows10-2004-x64

3

$PROGRAMFI...ent.js

windows7-x64

3

$PROGRAMFI...ent.js

windows10-2004-x64

3

$PROGRAMFI...oud.js

windows7-x64

3

$PROGRAMFI...oud.js

windows10-2004-x64

3

$PROGRAMFI...up.exe

windows7-x64

3

$PROGRAMFI...up.exe

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PROGRAMFI...IE.exe

windows7-x64

1

$PROGRAMFI...IE.exe

windows10-2004-x64

1

$SYSDIR/PAZU.dll

windows7-x64

1

$SYSDIR/PAZU.dll

windows10-2004-x64

1

$SYSDIR/PAZUVista.exe

windows7-x64

1

$SYSDIR/PAZUVista.exe

windows10-2004-x64

1

$SYSDIR/pa...st.exe

windows7-x64

1

$SYSDIR/pa...st.exe

windows10-2004-x64

1

$PROGRAMFI...om.dll

windows7-x64

3

$PROGRAMFI...om.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20/05/2024, 10:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5e941091299bcff65b7b6ea84aa9c2e9_JaffaCakes118.exe

  • Size

    365KB

  • MD5

    5e941091299bcff65b7b6ea84aa9c2e9

  • SHA1

    e68192f4420b0782afcf0d35403ae0f2c9a26450

  • SHA256

    2b90e389578f65caca0148d3e79eeb9bdafadb8345267033a0603a98dfd7d7ed

  • SHA512

    f134c339d3d43f23d215313514b02e42319f65d8ebd4d86dc412f9debec9f24ff32069c674511f4e011bf8dc063ddfe7e3728b0e109b1efaa10dcd2b39893b69

  • SSDEEP

    6144:18LxBh6yxLs7AFSYqNLaENrUXVZlO++OZC+Hd7vMCRGBTh1v4B7wskcnm/aYgxv:A6ywgPBLlOuHd7UvTh1vuwv/aLt

Score
8/10
persistence

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
    installer
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e941091299bcff65b7b6ea84aa9c2e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5e941091299bcff65b7b6ea84aa9c2e9_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Program Files (x86)\PAZUÔÆ´òÓ¡×é¼þ\temp\sc_setup_oem.exe
      "C:\Program Files (x86)\PAZUÔÆ´òÓ¡×é¼þ\temp\sc_setup_oem.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\pazuVistaInst.exe
        "C:\Windows\system32\pazuVistaInst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2240
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "CheckNetIsolation LoopbackExempt -a -p=S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194"
      2⤵
        PID:2616
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "CheckNetIsolation LoopbackExempt -a -n=Microsoft.Windows.Spartan_cw5n1h2txyewy"
        2⤵
          PID:2620
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe"
          2⤵
            PID:2732
          • C:\Program Files (x86)\PAZUÔÆ´òÓ¡×é¼þ\PAZUCloudSrv.exe
            "C:\Program Files (x86)\PAZUÔÆ´òÓ¡×é¼þ\PAZUCloudSrv.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            PID:2400

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\PAZUÔÆ´òÓ¡×é¼þ\config.ini
          Filesize

          23B

          MD5

          72c9c4a2cc14b42074522b971e5c99a6

          SHA1

          e3498cee7f57f82d87b113911661accd5a2cd3df

          SHA256

          cf02b2a2976515118b3bea7becd69e3abc22b49d0f5e4c3a3e1ecb0ba4cbeb50

          SHA512

          e9bc28ac50a3a37e709e8283c0a61c9bbc437e5b03a64d391ad994af4a12491612564a9fde32e50a134c2efe994f116bb926bd306db70775569bfdb903f8faee

          Download Submit

        • C:\Program Files (x86)\PAZUÔÆ´òÓ¡×é¼þ\sc_setup.exe
          Filesize

          199KB

          MD5

          7defbdc31ef10afad60b86e3880c9fea

          SHA1

          10aef9b8485ece78835e155f3f3742d6f8ff4fe5

          SHA256

          aff268123430a25a6d5879c2fe5415e1fc018cde783274313c26a8a3c2d56e3f

          SHA512

          5009fcb305c22657ae30cdaf79d4940e418edc53c04bcbcfb20b8db342a825ee2214ccc5d2925512085e8d0db2843fae22fd3ab98e000c57ba694fb92037aa30

          Download Submit

        • \Program Files (x86)\PAZUÔÆ´òÓ¡×é¼þ\PAZUCloudSrv.exe
          Filesize

          161KB

          MD5

          585bf14b7fd9ded9c0c98bed84fe78e6

          SHA1

          2a0b85350c0c1d3e8bf3d2c9155728d18e2ecca9

          SHA256

          71bd503327842f855bee5e055602ebb0c2c5e8f2b3f5983f4490718490ed4fde

          SHA512

          d321f71eafbeff06e22c928e847eb04ed84f99ffb912cfe0bc19008d6effe4b7ecf3447a9f79f4687cea4ed6c11eefc98b4fbe09152ce2710ba69a3d843a8ee6

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsd60A.tmp\nsProcess.dll
          Filesize

          4KB

          MD5

          faa7f034b38e729a983965c04cc70fc1

          SHA1

          df8bda55b498976ea47d25d8a77539b049dab55e

          SHA256

          579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

          SHA512

          7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsd60A.tmp\nsSCM.dll
          Filesize

          5KB

          MD5

          62efa7b730eb0523a026ea4325403b77

          SHA1

          806ed3bd677ccf5d9817c9b464015e347f2c8f3c

          SHA256

          0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38

          SHA512

          748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsy687.tmp\System.dll
          Filesize

          10KB

          MD5

          56a321bd011112ec5d8a32b2f6fd3231

          SHA1

          df20e3a35a1636de64df5290ae5e4e7572447f78

          SHA256

          bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

          SHA512

          5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

          Download Submit

        • \Windows\SysWOW64\PAZU.ocx
          Filesize

          193KB

          MD5

          f41f9c5a2a3c123aee141f3562d9799f

          SHA1

          d3501f807f8070a7432ec482e2b4e03d02a20f53

          SHA256

          de49fb40338aa5798989fae866e4d2d1e03aa6a301b151d6b58f5c37e679e52a

          SHA512

          b1387785fe0c86579cf92c9366ca19c6c60d156dd5c92aaba3d3de10655f7d457ac2f83b8926067ec644cd648a5f0abfda6b7b7b743675da281f98c090e49463

          Download Submit

        • \Windows\SysWOW64\pazuVistaInst.exe
          Filesize

          32KB

          MD5

          22275e8de6f1949149eb65b64eb277ea

          SHA1

          4b03a7c868c12dfc69eb908f6c369d82d83058f5

          SHA256

          fc3746216f06fab8fad0ca6ec6eeb37a60ab8d945b03dfb84eb58032e9837d8a

          SHA512

          f8ac3f562debc1d31d44cc43c9c174a3123118c524b3f7f036ad635a1391d0ca469fb0b7c425bce702e84810cfd7872e3edc424882c15913983bb05d27610fad

          Download Submit