36cbce31523dcd66b32bf1193725f3e04e3aa3d1f30df3ec275161c649d31a3c

Analysis

max time kernel
164s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe
Size 13.4MB
Sample240526-xp4trshc77
SHA256 36cbce31523dcd66b32bf1193725f3e04e3aa3d1f30df3ec275161c649d31a3c
MD5 7681b2aa2bb005968cb791f4c14acc08
SHA1 de7ad83e64f5cc95e9eb2bb30552a139d37ab299
SHA512 7d1044e4f0bb54b89c3e68f42e771ba27e1746d0c40af98f9d6cb27c81cf5a63001e291d914fc91c57001b58b4b3a1addd0f71ea75e8a983c8a6d87fcea71af8
SSDEEP 393216:FpAzXLKi/KForUnnXFwtAdPUqJyBTIm1GQvu:FpAfnlAnXFBdPU4yT1GQvu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3000	InstallTools.exe
888	bytefence-installer-5.5.0.7.exe

Loads dropped DLL 2 IoCs

pid	Process
888	bytefence-installer-5.5.0.7.exe
888	bytefence-installer-5.5.0.7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023266-6.dat	nsis_installer_1
behavioral2/files/0x0007000000023266-6.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3000	4764	7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe	92
PID 4764 wrote to memory of 3000	4764	7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe	92
PID 4764 wrote to memory of 3000	4764	7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe	92
PID 4764 wrote to memory of 888	4764	7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe	93
PID 4764 wrote to memory of 888	4764	7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe	93
PID 4764 wrote to memory of 888	4764	7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\InstallTools.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallTools.exe" "C:\Users\Admin\AppData\Local\Temp\7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe" Software\ByteFence INSNDE "C:\Users\Admin\AppData\Local\Temp\7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe" /mode=s /url=logs.bytefence.com/event /product=Bytefence
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe
  "C:\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe" /LM=3 /INSTEX /cd=12345 /thankyou /IGNORE="C:\Users\Admin\AppData\Local\Temp\7681b2aa2bb005968cb791f4c14acc08_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallTools.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallTools.exe
Size 274KB
SHA256 d7ffd96c98cdcd1bacbe7542b403d60a8b700ab8305de02738f1f1c2d98aa71f
MD5 7bfcafbcc8ee124ce3ea6b098105865a
SHA1 f404c9a50e0740e465106321012c3b7859c999dc
SHA512 02b873be813abc8a50b882bed60ad2c57ad6cba8f83984c30d2ca0b5dba6c5b6427d44626bd2689e179bff539160b78b3ff6b604d1d134a147e41c9861b1600c
SSDEEP 3072:0l7g2UXc+gHjgXqJV0BhZ1hgC5VQ+dVg6tsH3kksA7XDCEtXFD:SkxM+gE607ZEC5VFgkks4Xx9
MD5 SHA1 SHA512 SSDEEP

Submit Download

bytefence-installer-5.5.0.7.exe

Path C:\Users\Admin\AppData\Local\Temp\bytefence-installer-5.5.0.7.exe
Size 13.2MB
SHA256 223ab46425284dd4ae73f8e7ad478eca6a0dcb4902cbc2f203b73b7cfe0da90b
MD5 bd660f5e0f39dd05d5eefff4ce65c017
SHA1 956847325b76f4f02c8803f71204f4c747823ea2
SHA512 4fb02afb13c67c3d99cb0b183ca20ede069fb7a92cacd2f9bc73891e05a51bd6bd3ca2988fb71813444f9c9853ab8ad42193b234d5d0a60ca6a63355b51c0469
SSDEEP 393216:TAzXLKi/KForUnnXFwtAdPUqJyBTIm1GQv9:TAfnlAnXFBdPU4yT1GQv9
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss97D7.tmp\System.dll
Size 11KB
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nss97D7.tmp\nsDialogs.dll
Size 9KB
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
SSDEEP 96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads