Overview

overview

7

Static

static

7

6a37efdff3...18.exe

windows7-x64

7

6a37efdff3...18.exe

windows10-2004-x64

7

$PLUGINSDI...er.exe

windows7-x64

7

$PLUGINSDI...er.exe

windows10-2004-x64

7

$PLUGINSDI...BI.exe

windows7-x64

3

$PLUGINSDI...BI.exe

windows10-2004-x64

3

$PLUGINSDI...cc.exe

windows7-x64

7

$PLUGINSDI...cc.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...ed.htm

windows7-x64

1

$PLUGINSDI...ed.htm

windows10-2004-x64

1

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...lp.dll

windows7-x64

1

$PLUGINSDI...lp.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows7-x64

7

$PLUGINSDI...ay.dll

windows10-2004-x64

7

$PLUGINSDI...te.exe

windows7-x64

7

$PLUGINSDI...te.exe

windows10-2004-x64

7

$PLUGINSDI...st.dll

windows7-x64

1

$PLUGINSDI...st.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 07:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6a37efdff304091d8c708f2ae57be4ed_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    6a37efdff304091d8c708f2ae57be4ed

  • SHA1

    20057c859bac023ddc42e38f852d7426d990f889

  • SHA256

    1234fca475092501d14959a1150d53c1817759cfb3960376640065467590cd66

  • SHA512

    97b2aed90ca86fcd4cd45f56f5765921de40f160fb90dd5ca1cdfb0f5a4e65c8aa3f07adf21f50dbe2541b1823821948b021f046ef38ad7e220dd2958eba4cf2

  • SSDEEP

    24576:m4hbLZIjhYlBc7YX2TSsmLMrtJH9zMy4xChlyUQdp:X5LOFYlHsmYrwyqChYHdp

Score
7/10
evasiontrojan

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a37efdff304091d8c708f2ae57be4ed_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a37efdff304091d8c708f2ae57be4ed_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\BI\BI.exe { "json_send_time" : "23/5/2024 9:39:2:773" , "phase_type" : "regular" , "show_languages_combo" : "0" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "11788" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.4.131024.02" , "bundle_id" : "067b1312-3218-49c3-a841-4d4ca14a6500" , "machine_user_id" : "7TW6A2JJVG5F4GOWYYNTL8OQQJA8Z3KWHP606KDD6ECOQ0/4GMKSI5OTFJ+Z+JFZCS7ZQZE06IPN7AOI2ONSPA" , "send_attempt" : "0" , "user_browser_version" : "" , "user_browser" : "" , "stub_version" : "no_stub" , "activated_by_stub" : "0" , "channel_id" : "" , "installation_session_id" : "40D2437F-1F4E-4EE4-85A0-946B27D52F4A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2644
    • C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\BI\BI.exe { "user_ie_security_level" : "Medium-High" , "json_send_time" : "23/5/2024 9:39:38:560" , "phase_type" : "regular" , "internal_error_description" : "HttpPost result: try1- SendRequest Error (Err=0); try2- SendRequest Error (Err=0) (Err=0); try3- SendRequest Error (Err=0) (Err=0) (Err=0)" , "internal_error_number" : "3" , "is_parallel" : "0" , "mrs_id" : "" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "11788" , "general_status_code" : "2" , "duration_details" : " InitPluginsDir:0 initializeParams:327 load_BITool:0 send_BI_Init:31 load_DownloadACC:47 retrieveUISource:0 unpack_webappfolder:0 unpack_icon:0 RetrieveMainOfferKey:0 unpack_OpenCandyDll:31 unpack_BunndleDll:16 load_webapphost:0 unpack_ProxyInstaller:0 navigate_loadingUI:530 navigateAsync_constMainOffer:0 BuildUserProfile:0 retrieve cid:0 callService1:12106 callService1:11529 callService1:11512 " , "phase_duration" : "" , "error_details" : "Failed communicate with the DistributionEngineService. Inner Error: SendRequest Error (Err=0) (Err=0) (Err=0) InternalRetryNum: 3" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.9600.16428" , "user_default_browser_version" : "9.11.9600.16428" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "1.0" , "user_operating_system" : "Windows 7 Ultimate" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.4.131024.02" , "bundle_id" : "067b1312-3218-49c3-a841-4d4ca14a6500" , "machine_user_id" : "7TW6A2JJVG5F4GOWYYNTL8OQQJA8Z3KWHP606KDD6ECOQ0/4GMKSI5OTFJ+Z+JFZCS7ZQZE06IPN7AOI2ONSPA" , "send_attempt" : "0" , "user_browser_version" : "" , "user_browser" : "" , "stub_version" : "no_stub" , "activated_by_stub" : "0" , "channel_id" : "" , "installation_session_id" : "40D2437F-1F4E-4EE4-85A0-946B27D52F4A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1728
    • C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\BI\BI.exe { "json_send_time" : "23/5/2024 9:39:41:571" , "phase_type" : "technical" , "error_details" : "Error in displaying the Error offer UI. Internal error: No answer on Failed page" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.9600.16428" , "user_default_browser_version" : "9.11.9600.16428" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "1.0" , "user_operating_system" : "Windows 7 Ultimate" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.4.131024.02" , "bundle_id" : "067b1312-3218-49c3-a841-4d4ca14a6500" , "machine_user_id" : "7TW6A2JJVG5F4GOWYYNTL8OQQJA8Z3KWHP606KDD6ECOQ0/4GMKSI5OTFJ+Z+JFZCS7ZQZE06IPN7AOI2ONSPA" , "send_attempt" : "0" , "user_browser_version" : "" , "user_browser" : "" , "stub_version" : "no_stub" , "activated_by_stub" : "0" , "channel_id" : "" , "installation_session_id" : "40D2437F-1F4E-4EE4-85A0-946B27D52F4A" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "phase" : "Failed" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2408

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\Failed.htm
    Filesize

    6KB

    MD5

    4bca38bc78f5e8283655b1dda3d81b2c

    SHA1

    b1e61db910ebc37bcbf4650d773d727b15fc8554

    SHA256

    16b03f64adc522298a636a117869d821379e341314704a4eb7e2263689e76d91

    SHA512

    6b4559f2f658835ca3a5a8772f424415838990fd7b22ce9452577c6f1e92c8776fe8f25e2747e91dcf59b390084d82bc48f3bfaafb242c3374b0e98e81db3509

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\nsy1798.tmp\webapphost.dll
    Filesize

    827KB

    MD5

    4dc5c6692260f2191e1573dd1cb1bb32

    SHA1

    de77124c49f17798d2b576add2e1857515c35e10

    SHA256

    59f4916771a03fd9836df92196b31256c428fb50a287474359a55dcf03d32632

    SHA512

    9ab8135c7081487c8f9cca70bdb275553e722ac69aa1906af83657eb0ea8459feb0030e3417edff6abd1cce7ee06fc967babbd306e79911f767935db00fa549d

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsy1798.tmp\BI\BI.exe
    Filesize

    65KB

    MD5

    0781655ec56f48f0878cf9b8cfb96a26

    SHA1

    b72a9d7e146df7d10a3f1483c9a9d32c224b9fdb

    SHA256

    6122edbae7a047d7ea93fa7cf9383cbefca9e18b571c9f183f9a1bfd6d2faa77

    SHA512

    7d21d5d36bbd25cc63163387f70d4d01c68bbb99c94481ca33f494f4954c7e7e1b02c77d9297892373575751ec9825264b4af926c844f58abfb6a24ead5e1309

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsy1798.tmp\System.dll
    Filesize

    17KB

    MD5

    a4f38d1c7a480f5da1bb8097b8b939db

    SHA1

    b3129c2a0e61881381463f5e0cbbffa573daa845

    SHA256

    e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436

    SHA512

    fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsy1798.tmp\inetc.dll
    Filesize

    68KB

    MD5

    3f06f0843792d42062bea6a42ee8ac11

    SHA1

    0b054746b414653b1eb87f3a5550ced2b8d41340

    SHA256

    9db2b6fffadd4e383a7aa15d2c15596de12c7e523cc7e38ecf4a909b9196df12

    SHA512

    ea6884f612f973101179f29aeb938789392efb9f592cf6435c7f2d85f1a151cd559818a786341d46fa950fbe0af61fecb1bd6fd04f28b02666d5bdd203c7bffa

    Download Submit