355abb51590b8e8c8d971713a5c8494898c691e64aee269325d208fcc297bbc9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe
Size

13.4MB
MD5

6ac1811d11bb35e61caa524829699ae3
SHA1

50c666c78f6512ef8beac9f163daa6c2eb73fe4f
SHA256

355abb51590b8e8c8d971713a5c8494898c691e64aee269325d208fcc297bbc9
SHA512

785e72c805ac705efe09106918eb41d528f703f02eaf318f6cab25ff07bc014b26fefe9cba3882a8c5572080588cf9a918af555462be247d2970a0dec0871ffb
SSDEEP

393216:FpAzXLKi/KForUnnXFwtAdPUqJyBTIm1GQvN:FpAfnlAnXFBdPU4yT1GQvN

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

InstallTools.exebytefence-installer-5.5.0.7.exe

pid process

2188 InstallTools.exe
2108 bytefence-installer-5.5.0.7.exe

pid	process
2188	InstallTools.exe
2108	bytefence-installer-5.5.0.7.exe

Loads dropped DLL 4 IoCs

Processes:

6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exebytefence-installer-5.5.0.7.exe

pid	process
1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe
1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe
2108	bytefence-installer-5.5.0.7.exe
2108	bytefence-installer-5.5.0.7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bytefence-installer-5.5.0.7.exe

pid process

2108 bytefence-installer-5.5.0.7.exe

pid	process
2108	bytefence-installer-5.5.0.7.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe

description	pid	process	target process
PID 1792 wrote to memory of 2188	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	InstallTools.exe
PID 1792 wrote to memory of 2188	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	InstallTools.exe
PID 1792 wrote to memory of 2188	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	InstallTools.exe
PID 1792 wrote to memory of 2188	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	InstallTools.exe
PID 1792 wrote to memory of 2188	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	InstallTools.exe
PID 1792 wrote to memory of 2188	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	InstallTools.exe
PID 1792 wrote to memory of 2188	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	InstallTools.exe
PID 1792 wrote to memory of 2108	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	bytefence-installer-5.5.0.7.exe
PID 1792 wrote to memory of 2108	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	bytefence-installer-5.5.0.7.exe
PID 1792 wrote to memory of 2108	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	bytefence-installer-5.5.0.7.exe
PID 1792 wrote to memory of 2108	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	bytefence-installer-5.5.0.7.exe
PID 1792 wrote to memory of 2108	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	bytefence-installer-5.5.0.7.exe
PID 1792 wrote to memory of 2108	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	bytefence-installer-5.5.0.7.exe
PID 1792 wrote to memory of 2108	1792	6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe	bytefence-installer-5.5.0.7.exe

C:\Users\Admin\AppData\Local\Temp\6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\InstallTools.exe
"C:\Users\Admin\AppData\Local\Temp\InstallTools.exe" "C:\Users\Admin\AppData\Local\Temp\6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe" Software\ByteFence INSNDE "C:\Users\Admin\AppData\Local\Temp\6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe" /mode=s /url=logs.bytefence.com/event /product=Bytefence
2⤵
- Executes dropped EXE
PID:2188

C:\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe
"C:\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe" /LM=3 /INSTEX /cd=12345 /thankyou /IGNORE="C:\Users\Admin\AppData\Local\Temp\6ac1811d11bb35e61caa524829699ae3_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2108

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\InstallTools.exe
Filesize
274KB

MD5
7bfcafbcc8ee124ce3ea6b098105865a

SHA1
f404c9a50e0740e465106321012c3b7859c999dc

SHA256
d7ffd96c98cdcd1bacbe7542b403d60a8b700ab8305de02738f1f1c2d98aa71f

SHA512
02b873be813abc8a50b882bed60ad2c57ad6cba8f83984c30d2ca0b5dba6c5b6427d44626bd2689e179bff539160b78b3ff6b604d1d134a147e41c9861b1600c

Download Submit
\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe
Filesize
13.2MB

MD5
bd660f5e0f39dd05d5eefff4ce65c017

SHA1
956847325b76f4f02c8803f71204f4c747823ea2

SHA256
223ab46425284dd4ae73f8e7ad478eca6a0dcb4902cbc2f203b73b7cfe0da90b

SHA512
4fb02afb13c67c3d99cb0b183ca20ede069fb7a92cacd2f9bc73891e05a51bd6bd3ca2988fb71813444f9c9853ab8ad42193b234d5d0a60ca6a63355b51c0469

Download Submit
\Users\Admin\AppData\Local\Temp\nso1E0D.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
\Users\Admin\AppData\Local\Temp\nso1E0D.tmp\nsDialogs.dll
Filesize
9KB

MD5
ab101f38562c8545a641e95172c354b4

SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads