Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 14:35
Static task
static1
Behavioral task
behavioral1
Sample
63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Convert.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Convert.dll
Resource
win10v2004-20240508-en
General
-
Target
63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe
-
Size
975KB
-
MD5
63a3e6c73460231f307171285ac5dcbb
-
SHA1
15134d54ce399e4aff7be4d4d982635521713ff3
-
SHA256
14bdaaf27edb050eca872155461fbaa0374c9b052f4199fd0ce70e0ce2dd51ad
-
SHA512
404324917dfc9f365bbbc2bb0d62cb686c9afcfc87598bf8373d9ecd3096589f30a5df3e48b63ffff6d22611e0aac0dbf3927559392642cbcc1b99a6e9b16046
-
SSDEEP
24576:2mheA/Lz7PFVke3dv6FfajLAf0DmKbfKy5mZr:HheA/LPPFVk0vy6EcDLyyEZr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
f.exepid process 1708 f.exe -
Loads dropped DLL 9 IoCs
Processes:
63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exeWerFault.exepid process 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe 2644 WerFault.exe 2644 WerFault.exe 2644 WerFault.exe 2644 WerFault.exe 2644 WerFault.exe 2644 WerFault.exe 2644 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2644 1708 WerFault.exe f.exe -
Modifies registry class 34 IoCs
Processes:
f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\ = "CBrowserExternal Class" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS\ = "0" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version\ = "1.0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5} f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0 f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32 f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32 f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\ = "SmartInstallerLib" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ = "IBrowserExternals" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982} f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib\Version = "1.0" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Programmable f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f.exe\"" f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib\ = "{03771AEF-400D-4A13-B712-25878EC4A3F5}" f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2540 wmic.exe Token: SeSecurityPrivilege 2540 wmic.exe Token: SeTakeOwnershipPrivilege 2540 wmic.exe Token: SeLoadDriverPrivilege 2540 wmic.exe Token: SeSystemProfilePrivilege 2540 wmic.exe Token: SeSystemtimePrivilege 2540 wmic.exe Token: SeProfSingleProcessPrivilege 2540 wmic.exe Token: SeIncBasePriorityPrivilege 2540 wmic.exe Token: SeCreatePagefilePrivilege 2540 wmic.exe Token: SeBackupPrivilege 2540 wmic.exe Token: SeRestorePrivilege 2540 wmic.exe Token: SeShutdownPrivilege 2540 wmic.exe Token: SeDebugPrivilege 2540 wmic.exe Token: SeSystemEnvironmentPrivilege 2540 wmic.exe Token: SeRemoteShutdownPrivilege 2540 wmic.exe Token: SeUndockPrivilege 2540 wmic.exe Token: SeManageVolumePrivilege 2540 wmic.exe Token: 33 2540 wmic.exe Token: 34 2540 wmic.exe Token: 35 2540 wmic.exe Token: SeIncreaseQuotaPrivilege 2540 wmic.exe Token: SeSecurityPrivilege 2540 wmic.exe Token: SeTakeOwnershipPrivilege 2540 wmic.exe Token: SeLoadDriverPrivilege 2540 wmic.exe Token: SeSystemProfilePrivilege 2540 wmic.exe Token: SeSystemtimePrivilege 2540 wmic.exe Token: SeProfSingleProcessPrivilege 2540 wmic.exe Token: SeIncBasePriorityPrivilege 2540 wmic.exe Token: SeCreatePagefilePrivilege 2540 wmic.exe Token: SeBackupPrivilege 2540 wmic.exe Token: SeRestorePrivilege 2540 wmic.exe Token: SeShutdownPrivilege 2540 wmic.exe Token: SeDebugPrivilege 2540 wmic.exe Token: SeSystemEnvironmentPrivilege 2540 wmic.exe Token: SeRemoteShutdownPrivilege 2540 wmic.exe Token: SeUndockPrivilege 2540 wmic.exe Token: SeManageVolumePrivilege 2540 wmic.exe Token: 33 2540 wmic.exe Token: 34 2540 wmic.exe Token: 35 2540 wmic.exe Token: SeIncreaseQuotaPrivilege 2456 wmic.exe Token: SeSecurityPrivilege 2456 wmic.exe Token: SeTakeOwnershipPrivilege 2456 wmic.exe Token: SeLoadDriverPrivilege 2456 wmic.exe Token: SeSystemProfilePrivilege 2456 wmic.exe Token: SeSystemtimePrivilege 2456 wmic.exe Token: SeProfSingleProcessPrivilege 2456 wmic.exe Token: SeIncBasePriorityPrivilege 2456 wmic.exe Token: SeCreatePagefilePrivilege 2456 wmic.exe Token: SeBackupPrivilege 2456 wmic.exe Token: SeRestorePrivilege 2456 wmic.exe Token: SeShutdownPrivilege 2456 wmic.exe Token: SeDebugPrivilege 2456 wmic.exe Token: SeSystemEnvironmentPrivilege 2456 wmic.exe Token: SeRemoteShutdownPrivilege 2456 wmic.exe Token: SeUndockPrivilege 2456 wmic.exe Token: SeManageVolumePrivilege 2456 wmic.exe Token: 33 2456 wmic.exe Token: 34 2456 wmic.exe Token: 35 2456 wmic.exe Token: SeIncreaseQuotaPrivilege 2456 wmic.exe Token: SeSecurityPrivilege 2456 wmic.exe Token: SeTakeOwnershipPrivilege 2456 wmic.exe Token: SeLoadDriverPrivilege 2456 wmic.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exef.exedescription pid process target process PID 2932 wrote to memory of 1708 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe f.exe PID 2932 wrote to memory of 1708 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe f.exe PID 2932 wrote to memory of 1708 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe f.exe PID 2932 wrote to memory of 1708 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe f.exe PID 2932 wrote to memory of 1708 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe f.exe PID 2932 wrote to memory of 1708 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe f.exe PID 2932 wrote to memory of 1708 2932 63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe f.exe PID 1708 wrote to memory of 2540 1708 f.exe wmic.exe PID 1708 wrote to memory of 2540 1708 f.exe wmic.exe PID 1708 wrote to memory of 2540 1708 f.exe wmic.exe PID 1708 wrote to memory of 2540 1708 f.exe wmic.exe PID 1708 wrote to memory of 2456 1708 f.exe wmic.exe PID 1708 wrote to memory of 2456 1708 f.exe wmic.exe PID 1708 wrote to memory of 2456 1708 f.exe wmic.exe PID 1708 wrote to memory of 2456 1708 f.exe wmic.exe PID 1708 wrote to memory of 2472 1708 f.exe wmic.exe PID 1708 wrote to memory of 2472 1708 f.exe wmic.exe PID 1708 wrote to memory of 2472 1708 f.exe wmic.exe PID 1708 wrote to memory of 2472 1708 f.exe wmic.exe PID 1708 wrote to memory of 2460 1708 f.exe wmic.exe PID 1708 wrote to memory of 2460 1708 f.exe wmic.exe PID 1708 wrote to memory of 2460 1708 f.exe wmic.exe PID 1708 wrote to memory of 2460 1708 f.exe wmic.exe PID 1708 wrote to memory of 2892 1708 f.exe wmic.exe PID 1708 wrote to memory of 2892 1708 f.exe wmic.exe PID 1708 wrote to memory of 2892 1708 f.exe wmic.exe PID 1708 wrote to memory of 2892 1708 f.exe wmic.exe PID 1708 wrote to memory of 2644 1708 f.exe WerFault.exe PID 1708 wrote to memory of 2644 1708 f.exe WerFault.exe PID 1708 wrote to memory of 2644 1708 f.exe WerFault.exe PID 1708 wrote to memory of 2644 1708 f.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63a3e6c73460231f307171285ac5dcbb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f.exeC:\Users\Admin\AppData\Local\Temp\f.exe /PID=7302 /SUBPID=0 /DISTID=13467 /NETWORKID=0 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=http://installer.apps-track.com /CLICKID=877351292 /D1=13516 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_NAME= /PRODUCT_EULA= /PRODUCT_PRIVACY= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /IS_RUNTIME=true /THANKYOU_URL= /RETURNING_USER_DAYS=2 /VM=22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\obhhelper.txt bios get version3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 3683⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\obhhelper.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
C:\Users\Admin\AppData\Local\Temp\obhhelper.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\obhhelper.txtFilesize
58B
MD5dd876faf0fd44a5fab3e82368e2e8b15
SHA101b04083fa278dda3a81705ca5abcfee487a3c90
SHA2565602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9
SHA512e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b
-
\Users\Admin\AppData\Local\Temp\f.exeFilesize
1.3MB
MD531a5ec2d13cfa575fab843164163f093
SHA16c4bea15f2a864e8c0bb467b369c1607aded4594
SHA25676aceaf88844c4f89763a1fc50ab90871aa08e9e770c697655334cfe26b35e3c
SHA5128227f81766e2d8d4ef1ea9d799a143580e9acdb4eebeb71177629aa66cf791c13fdd42b899bb9761ad3b0606a0a702aa1f0328faaa2839506e7221eed8a44e1d
-
\Users\Admin\AppData\Local\Temp\nsy1575.tmp\Convert.dllFilesize
114KB
MD500321d477f76e401373c1fc71c7c4502
SHA1cb010222cb25d67810f46d20c4daffea60b86c6e
SHA25648db77073c6ab1ab2a0f0d80a21d1a17bee5ed745735b2a780b137bf06681c43
SHA5126974617a9482b08f41db8575e123f82d76c18ae8dc2aae605b6d3bee0dce52f55de061283ca4c3eb0579eeaa0261f09cb98c611b0b5d502b37b3169e0bba4f85