dbfdf8e451c3dabf8be991f38284e114cc208432b6cce1ff2a132fff129e29c5

Analysis

max time kernel
152s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
Size

1.5MB
MD5

68f15793cd17480d51f9502c42455820
SHA1

e9f561ccb6459315d7a3b5fb2ba414ce5669968f
SHA256

dbfdf8e451c3dabf8be991f38284e114cc208432b6cce1ff2a132fff129e29c5
SHA512

f1757e7de967322f87dfc08ac5d03c06e7955a0096c10de41014b5d0c41df794766ef2692fcc2768ca3494b0c8ced41d986392b9e83107e3e261ffc131699b83
SSDEEP

24576:u9IyvSiqdMexsVSzGLqVrWyTLQWTrvYtvAETM5ynvXtXJrujxUDyCBsJ82v0uwmD:MqiexqSQwFJTivAETM4nvxhaq/B5W0IB

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System32\drivers\crfilterdrv.sys	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\drivers\crfilterdrv.sys	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
behavioral2/memory/1184-46-0x0000000073520000-0x0000000073529000-memory.dmp	acprotect
C:\Users\Admin\AppData\Local\Temp\nsaC7C6.tmp\SelfDel.dll	acprotect

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

2504 explorer.exe
Executes dropped EXE 3 IoCs

Processes:

nfregdrv.exeCashReminder.exeCashReminder.exe

pid process

4936 nfregdrv.exe
4452 CashReminder.exe
3128 CashReminder.exe

pid	process
2504	explorer.exe

pid	process
4936	nfregdrv.exe
4452	CashReminder.exe
3128	CashReminder.exe

Loads dropped DLL 19 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exenfregdrv.exeCashReminder.exeCashReminder.exe

pid	process
1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
4936	nfregdrv.exe
1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
4452	CashReminder.exe
1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
4452	CashReminder.exe
4452	CashReminder.exe
4452	CashReminder.exe
4452	CashReminder.exe
4452	CashReminder.exe
4452	CashReminder.exe
3128	CashReminder.exe
3128	CashReminder.exe
3128	CashReminder.exe
3128	CashReminder.exe
3128	CashReminder.exe
3128	CashReminder.exe
3128	CashReminder.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1184-46-0x0000000073520000-0x0000000073529000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\nsaC7C6.tmp\SelfDel.dll	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

Processes:

CashReminder.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	CashReminder.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	CashReminder.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	CashReminder.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	CashReminder.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

description pid process target process

PID 1184 set thread context of 2504 1184 68f15793cd17480d51f9502c42455820_JaffaCakes118.exe explorer.exe

description	pid	process	target process
PID 1184 set thread context of 2504	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe

Drops file in Program Files directory 9 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\CashReminder\ssleay32.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\libeay32.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\CashReminder.exe	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\ProtocolFilters.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\crfilterdrv.sys	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\nfregdrv.exe	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\remove.exe	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\CashReminder\crfilterdrv.sys	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\nfapi.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

Processes:

CashReminder.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	CashReminder.exe

Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

668
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

pid process

1184 68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

pid	process
668

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exeCashReminder.execmd.exenet.exe

description	pid	process	target process
PID 1184 wrote to memory of 4936	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	nfregdrv.exe
PID 1184 wrote to memory of 4936	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	nfregdrv.exe
PID 1184 wrote to memory of 4936	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	nfregdrv.exe
PID 1184 wrote to memory of 4452	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	CashReminder.exe
PID 1184 wrote to memory of 4452	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	CashReminder.exe
PID 1184 wrote to memory of 4452	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	CashReminder.exe
PID 1184 wrote to memory of 2504	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 1184 wrote to memory of 2504	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 1184 wrote to memory of 2504	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 1184 wrote to memory of 2504	1184	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 4452 wrote to memory of 4268	4452	CashReminder.exe	cmd.exe
PID 4452 wrote to memory of 4268	4452	CashReminder.exe	cmd.exe
PID 4452 wrote to memory of 4268	4452	CashReminder.exe	cmd.exe
PID 4268 wrote to memory of 4804	4268	cmd.exe	net.exe
PID 4268 wrote to memory of 4804	4268	cmd.exe	net.exe
PID 4268 wrote to memory of 4804	4268	cmd.exe	net.exe
PID 4804 wrote to memory of 3056	4804	net.exe	net1.exe
PID 4804 wrote to memory of 3056	4804	net.exe	net1.exe
PID 4804 wrote to memory of 3056	4804	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68f15793cd17480d51f9502c42455820_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1184

C:\Program Files (x86)\CashReminder\nfregdrv.exe
nfregdrv.exe C:\Windows\system32\drivers\crfilterdrv.sys
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4936

C:\Program Files (x86)\CashReminder\CashReminder.exe
"C:\Program Files (x86)\CashReminder\CashReminder.exe" /install /SILENT
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net start CashReminder
3⤵
- Suspicious use of WriteProcessMemory
PID:4268

C:\Windows\SysWOW64\net.exe
net start CashReminder
4⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start CashReminder
5⤵
PID:3056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\system32\explorer.exe
2⤵
- Deletes itself
PID:2504

C:\Program Files (x86)\CashReminder\CashReminder.exe
"C:\Program Files (x86)\CashReminder\CashReminder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:224

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CashReminder\CashReminder.exe
Filesize
433KB

MD5
e6791bdbe847d61dd230d755959f2da5

SHA1
dd8594aeb11317135d36382a1961bc9d5893c97f

SHA256
1598a10fd9bff8ba91aca0e500cf6d0c8b338d34adf4559adf2af5c1a0964b09

SHA512
f80e64a7d15bee857a7c38fefa2cb7490a46427cce0b972ffdf96c90ea99f698e069672e7ea7570e8d76fba07a664699468009d1e6173d83cdc9fc94e60135e8

Download Submit
C:\Program Files (x86)\CashReminder\ProtocolFilters.dll
Filesize
360KB

MD5
fab8104ced422c551bcf2dda631e5930

SHA1
ccdb59de36d3ca7fe080f173bf437a98701a367b

SHA256
34fd513f254f3491a314b64f8883b289ab96a2b975ce6fa357c0ae11ed12d3df

SHA512
52608279186f108284bef7cf5e6031d67ae1d700121a22ef7da00a8ef81ae2430e64adabd2fa9c186ebf7d7d5c9df8bd0183d35071d4c1e594e8118a0f576870

Download Submit
C:\Program Files (x86)\CashReminder\crfilterdrv.sys
Filesize
56KB

MD5
6101d0684771455104ab5258de31efd6

SHA1
1e6ecd70be8b4a19b6ba5c5127206b6ed75bede5

SHA256
c3a4e9d6de0f43c1b367e74d6b9a29399fcd5485b6598350c84ac5d6a700a1d5

SHA512
7b19e75123524b2da551fcbc48a945f49735fac4a4457609b11b6d86187acf1ebba3cee58218c043c413a1bd799875a87c029e1dd78125fb762323fa37b96ab4

Download Submit
C:\Program Files (x86)\CashReminder\libeay32.dll
Filesize
1.4MB

MD5
47a9d585dbf59f54574d978c4200a520

SHA1
ee99ab151751ee720833efb0c3a031d09bd13833

SHA256
421454bccf67fe6def1c13ff6314fd3fb69d667a421a1c1461209164bc9ad780

SHA512
d23516719ff06134c8614d27813b828b7815298404824623ae25a35dafde6515ebf80476405235933faad9bc70acfe5e295e8fabe5af091f544a23f3e2a0b565

Download Submit
C:\Program Files (x86)\CashReminder\nfapi.dll
Filesize
124KB

MD5
04a835251535006c85473a604fba8bdc

SHA1
4bed678d9836e20d1f48792a8f4ba1d41e94f629

SHA256
e99db65a51db72018f0469b6d5096a2d469b790efdeec50a955b8ac4e19f16e8

SHA512
e47c5072fd8b581e8312148ca48490a86d4f51d58e6acef90d3d3de8bca5660d62a1b935357f9307c6f89cc35d1d332b0f42f402abf87a8959d4c29af8e5ee67

Download Submit
C:\Program Files (x86)\CashReminder\nfregdrv.exe
Filesize
48KB

MD5
01b5780505301ada6dc102fb77b2298c

SHA1
328c3931a54af2d7adb88ba4c4c18ce1af8d5a72

SHA256
aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812

SHA512
bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947

Download Submit
C:\Program Files (x86)\CashReminder\ssleay32.dll
Filesize
368KB

MD5
2da6e9df4979ca65a01c4df6eb5600d2

SHA1
8bb90aca4e3387629e76d5c8cb53743990d891ec

SHA256
bfb7a9a4d5501d21cd575ec6f65b10ec3d43e6bc137d7b6469daf24ee0b65d14

SHA512
e146c42fee06702b80ca46d7a281a8c0600b9a35213accac29dc3c505d9d1f0405c4a69f22258042fbe4d35278c2c47ba878b1f2bfaa739eb1501428ea5f90af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC7C6.tmp\SelfDel.dll
Filesize
5KB

MD5
e5786e8703d651bc8bd4bfecf46d3844

SHA1
fee5aa4b325deecbf69ccb6eadd89bd5ae59723f

SHA256
d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774

SHA512
d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC7C6.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaC7C6.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/1184-31-0x0000000002630000-0x0000000002643000-memory.dmp

Filesize
76KB

Download
memory/1184-46-0x0000000073520000-0x0000000073529000-memory.dmp

Filesize
36KB

Download
memory/1184-70-0x0000000073520000-0x0000000073529000-memory.dmp

Filesize
36KB

Download
memory/3128-84-0x0000000000880000-0x00000000009F3000-memory.dmp

Filesize
1.4MB

Download
memory/3128-76-0x00000000005D0000-0x000000000062C000-memory.dmp

Filesize
368KB

Download
memory/3128-81-0x0000000000820000-0x000000000087D000-memory.dmp

Filesize
372KB

Download
memory/3128-86-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4452-55-0x0000000000950000-0x00000000009AD000-memory.dmp

Filesize
372KB

Download
memory/4452-48-0x00000000008E0000-0x000000000093C000-memory.dmp

Filesize
368KB

Download
memory/4452-59-0x00000000009B0000-0x0000000000B23000-memory.dmp

Filesize
1.4MB

Download
memory/4452-69-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/4452-71-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download