Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe
-
Size
4.9MB
-
MD5
77877a57ab2d93042bae010c7342a423
-
SHA1
a3ea2c10c6812257a650d7890d7a278d8b67d371
-
SHA256
677471e9121f4a29a8b0ea4e6a1c730bd0e2908f1c517c8356909f69007efab3
-
SHA512
979fe536402cb3ea776274ed3f961507508334e518bbe5ad589855e3aa46deac0766e02c91bf9dba8a91ebf6a75b9c9a18efc24c6ca4f22e712c7f3f9a6e08df
-
SSDEEP
98304:pAI+mVN/BclFu8oj2/sJ1QXzy6R/ib93ov7D9EHudivaA3LFS07uvdRu3N6lXo91:itkWFUjv1ozD9EHIkFSocd4Ae1
Score
10/10
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 1 IoCs
pid Process 576 AU3_raps.exe -
Loads dropped DLL 2 IoCs
pid Process 2220 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe 2220 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\Microsoft.Win32.TaskScheduler.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\PegasunCD.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\nl-NL\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\nl-NL.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\PegasunCD.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\el-GR\PCCleaner.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\en-US.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\fr-FR\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\hu-HU\PCCleaner.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\ServiceManager.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\SSU-Settings.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\Themes\BackgroundImages\Header-Blue.png 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\el-GR\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\pt-BR.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\RegistryCleaner.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\SDC-AdvSig.dat 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\it-IT\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\PrivacyGuardian.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\SystemUtilities.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\hu-HU\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\pt-BR\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\SSU-Settings.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\TuneUP.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\ru-RU\PCCleaner.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\ru-RU\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\ScheduleManager.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\StartupManager.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\BackupManager.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\ar-SA.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\el-GR.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\pt-BR\PCCleaner.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\Themes\BackgroundImages\BI-Sanctuary.jpg 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\TuneUP.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\AU3_raps.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File created C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\Uninstall.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\es-ES\PCCleaner.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\hu-HU.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\SpywareDefender.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\sHelper.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\SystemUtilities.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\RegistryCleaner.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\hr-BA\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\Pegasun-Help.chm 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\ScheduleManager.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\sHelper.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\BackupManager.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\Defragmentor.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\de-DE.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\fr-FR.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\SpywareDefender.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\SSM-Services.dat 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\tr-TR\SystemUtilities.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\PCCleaner.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\hr-BA.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\it-IT.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\ru-RU.ini 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\StartupManager.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\unins000.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\ar-SA\PCCleaner.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\lang\de-DE\PCCleaner.resources.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\Pegasun-Helper.dll 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\SD-Signatures.dat 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\ServiceManager.exe.config 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\Uninstall.exe 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 576 2220 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe 28 PID 2220 wrote to memory of 576 2220 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe 28 PID 2220 wrote to memory of 576 2220 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe 28 PID 2220 wrote to memory of 576 2220 77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\77877a57ab2d93042bae010c7342a423_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\AU3_raps.exe"C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\AU3_raps.exe"2⤵
- Executes dropped EXE
PID:576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\Defragmentor.exe.config
Filesize214B
MD54194fa999171a240c821cc4a7b765439
SHA1d88eb7d47ac4ef13b1468baed9a74ff7bf912523
SHA2564665799ac4d842fa2b2ab354144d6ebcc7529f429d972048d778a06a05d29583
SHA51260785ed9a2fb2bdfec4e13ccbece50e7e81c408727084317b60a1be88ae2b2d6a3b0008da82f507a7a2bdac1a22584759c3fbacaf0bc602fd53f19a7043bb8b7
-
C:\Program Files (x86)\Pegasun&Chistilka\Pegasun&Chistilka\SystemUtilities\bin\PrivacyGuardian.exe.config
Filesize231B
MD52577e4b144efcb577e51c1439155079a
SHA18ac376d232d195179755bbfd1b20555e28fffddd
SHA256bb7acfd577ed69baff19c245537c289b340d559f2b4152f9f3c1db9cc97ecde9
SHA512321506f74ca86e344bac3a79520de995501d18d634471f980fb314d1ee32ee2dd2705a2a608625f3d6b109eb444fc50ab83754d9a88f40ca86ebb0b8f5468578
-
Filesize
212KB
MD5697051cd93a6bcd50e02955f089a9d0e
SHA16ba844cf9230a52ec25a76aa42bdec4aac79ba0e
SHA256d5e2867f294649fc73f632f6c02b71b94b952ec44562f41aef59d7a878778098
SHA51216612f71aa03eef077f20394164532e33c7e2e9c1384c4a857e77be77b9f629d43edb78db85a877906248b474f8ba69213f34199a657d254c915a7da9ac7aeb2