6b7eace348b11fc8fb50a6e40492839972dfda5853ed83d86f73c9017af01089

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe
Size

1.2MB
MD5

80ede1662b42a7b11aecfda957382ac2
SHA1

cd6535588a45a3ef117ba780e8de10b749a166ac
SHA256

6b7eace348b11fc8fb50a6e40492839972dfda5853ed83d86f73c9017af01089
SHA512

c3235151a3887948a63d89a25e56801176d7e65a5a6a6b9421fc92bebf67db666af24018f8643ae7a23c0157cccbfa46d539c15341ba0d1fbdf4959e994c6d83
SSDEEP

24576:FCXXvmjWP/UVldr7wh3dsT8FRZuzslwXpdy2NZQ6yHp4PZwfQ95a3gm:oXFHmr0NsEuYA82HEHiPZwW5awm

Score

7^/10

bootkit persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000015e6d-46.dat	acprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000015d44-40.dat	upx
behavioral1/memory/2516-45-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2356-44-0x0000000003620000-0x0000000003774000-memory.dmp	upx
behavioral1/files/0x0006000000015e6d-46.dat	upx
behavioral1/memory/2516-52-0x0000000010000000-0x000000001009F000-memory.dmp	upx
behavioral1/memory/2516-153-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-156-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-157-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-159-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-161-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-163-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-165-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-167-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-169-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-171-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-173-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-175-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-177-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-179-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2516-181-0x0000000000400000-0x0000000000554000-memory.dmp	upx

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Free Ride Games.exe
File opened (read-only)	\??\B:	Free Ride Games.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Free Ride Games.exe

Executes dropped EXE 13 IoCs

pid	Process
2516	Free Ride Games.exe
2968	cmhelper.exe
2712	cmhelper.exe
2752	cmhelper.exe
2796	cmhelper.exe
1976	cmhelper.exe
2284	cmhelper.exe
112	cmhelper.exe
1912	cmhelper.exe
2584	cmhelper.exe
816	cmhelper.exe
1684	cmhelper.exe
2988	cmhelper.exe

Loads dropped DLL 18 IoCs

pid	Process
2356	80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe
2356	80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe
2356	80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
2712	cmhelper.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
1976	cmhelper.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
1912	cmhelper.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
1684	cmhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Free Ride Games.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Free Ride Games.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	Free Ride Games.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2516	Free Ride Games.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2516	Free Ride Games.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe
2516	Free Ride Games.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2516	2356	80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe	28
PID 2356 wrote to memory of 2516	2356	80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe	28
PID 2356 wrote to memory of 2516	2356	80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe	28
PID 2356 wrote to memory of 2516	2356	80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe	28
PID 2516 wrote to memory of 2968	2516	Free Ride Games.exe	29
PID 2516 wrote to memory of 2968	2516	Free Ride Games.exe	29
PID 2516 wrote to memory of 2968	2516	Free Ride Games.exe	29
PID 2516 wrote to memory of 2968	2516	Free Ride Games.exe	29
PID 2712 wrote to memory of 2752	2712	cmhelper.exe	31
PID 2712 wrote to memory of 2752	2712	cmhelper.exe	31
PID 2712 wrote to memory of 2752	2712	cmhelper.exe	31
PID 2712 wrote to memory of 2752	2712	cmhelper.exe	31
PID 2516 wrote to memory of 2796	2516	Free Ride Games.exe	32
PID 2516 wrote to memory of 2796	2516	Free Ride Games.exe	32
PID 2516 wrote to memory of 2796	2516	Free Ride Games.exe	32
PID 2516 wrote to memory of 2796	2516	Free Ride Games.exe	32
PID 1976 wrote to memory of 2284	1976	cmhelper.exe	34
PID 1976 wrote to memory of 2284	1976	cmhelper.exe	34
PID 1976 wrote to memory of 2284	1976	cmhelper.exe	34
PID 1976 wrote to memory of 2284	1976	cmhelper.exe	34
PID 2516 wrote to memory of 112	2516	Free Ride Games.exe	35
PID 2516 wrote to memory of 112	2516	Free Ride Games.exe	35
PID 2516 wrote to memory of 112	2516	Free Ride Games.exe	35
PID 2516 wrote to memory of 112	2516	Free Ride Games.exe	35
PID 1912 wrote to memory of 2584	1912	cmhelper.exe	37
PID 1912 wrote to memory of 2584	1912	cmhelper.exe	37
PID 1912 wrote to memory of 2584	1912	cmhelper.exe	37
PID 1912 wrote to memory of 2584	1912	cmhelper.exe	37
PID 2516 wrote to memory of 816	2516	Free Ride Games.exe	38
PID 2516 wrote to memory of 816	2516	Free Ride Games.exe	38
PID 2516 wrote to memory of 816	2516	Free Ride Games.exe	38
PID 2516 wrote to memory of 816	2516	Free Ride Games.exe	38
PID 1684 wrote to memory of 2988	1684	cmhelper.exe	40
PID 1684 wrote to memory of 2988	1684	cmhelper.exe	40
PID 1684 wrote to memory of 2988	1684	cmhelper.exe	40
PID 1684 wrote to memory of 2988	1684	cmhelper.exe	40

C:\Users\Admin\AppData\Local\Temp\80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\80ede1662b42a7b11aecfda957382ac2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
  "C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '638050' m 'Freegame_bing' t '0' l 'Default'"
  2⤵
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPR
    3⤵
    - Executes dropped EXE
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPW
    3⤵
    - Executes dropped EXE
    PID:2796
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPW
    3⤵
    - Executes dropped EXE
    PID:112
- - C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    UPW
    3⤵
    - Executes dropped EXE
    PID:816

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  R
  2⤵
  - Executes dropped EXE
  PID:2752

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  W
  2⤵
  - Executes dropped EXE
  PID:2284

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  W
  2⤵
  - Executes dropped EXE
  PID:2584

C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
"C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
  W
  2⤵
  - Executes dropped EXE
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

Filesize
23B

MD5
4174cb800274e3c271f7e53ae1b9ae35

SHA1
6ac0ca77eef3b68c8db3349f1ceb0c8083450642

SHA256
d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e

SHA512
c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

Filesize
124B

MD5
e6d4b8ec4bc00af78768ad99563d6967

SHA1
63307ca0273f3e7252d50bc402d676de0d8e2109

SHA256
b4929a37ccf29169d0dd330ab67c6d6259243bd4c51726309c2fd1c0675a6d25

SHA512
2b1dab4945164f5e26284a43c2358a608d920ad55994128bfdf1562912b064cdf3446ee497b2bf6c49073765e48dd08f3a863c16d111d0c5c37668405f8b4af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

Filesize
241B

MD5
3ff229ca237e3a385357e246465dc178

SHA1
d5ce08addccc9ec013e9ffef00eeaf06bd31a5e9

SHA256
e4d1ec3dc01d1c9f13dd37c9fe0fc98da52cc6c59b62dd40131f5902b085f1ac

SHA512
01b8a00b52336cf334ba46a56622e4c200aced8cddf5dadc0769a79fd4c307a484c6f02c7b0fc823ab9a293857b8df85b956258ca79ea3a5f4c6cb5477ab88ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

Filesize
357B

MD5
000b21a7267113573c5146bb6d1327e2

SHA1
5f049c1e3d56e2af7c896b23493b659be7b740c8

SHA256
be3778f1cff49b77c3db8a1b381d8e00f8336d5965fe5ecbe1e7df2c75504741

SHA512
26c75675038614acd5674161397f6bb9f4eb6a55b436e6ac66ab2a2708b608db7444420766c84aeb2fa277cea774b5703d3328e27d68e7a4c848394ece0bb31a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

Filesize
234KB

MD5
2c3c18baaee7775b6d588cdf1529e528

SHA1
88fa58fbabde59e80c96e7676730ca40d1649b9a

SHA256
9c980d85903561c44f84faaee80d911bf3c9ef9d238fe69b7ccc6998d0fe9232

SHA512
4b69953b02d5c810003eb938da85b51b4906c48e48f441175a3ab76b6e8e5dc293ee683a9c90503b3db4ae72cd6557b8609dc1f4fefc82322f946a7072208348

Download Submit
C:\Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

Filesize
171KB

MD5
0c395ce6f6961054219b6d34927f8903

SHA1
55fd653c8f6d1253e221d49f1dd097ea73262d55

SHA256
e31a495075247fba426b5a4928560a578eaab44f828a2fdca496a05589509352

SHA512
e6b2f487eea8c5687a41ad58d955cb67b48881a728eb84f730a1d8ec50057bf80f77a21e22ad977673bff9d783deac02ebeab7252ccc7f98b3ecc34486b2b67b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DDLX73OI.txt

Filesize
330B

MD5
4b638f80aae3d4d0aa1ea02d947521be

SHA1
9e082d7742e259468ae0d62985dfe2d7e3238bcf

SHA256
79a34710decbaf6c6bef8c03fb46fc51e0ea578dc94a0d87e3c2913013c9d398

SHA512
4375f74c88c72d753f61ba25f0fa43ebff959504a0aee73d9761b406d2be6e1023b095402f4d7847702eafee4d91c69f6bd62b341a3cfaf8954e7dda4f362a4f

Download Submit
\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

Filesize
503KB

MD5
dc7b5f12c7ff9af697203cb0c59a3516

SHA1
1769c4f64f8ab818a797e3fa1e5331a50ffdd678

SHA256
b07ca37c2938966d2290c8b76f039febe8da9a919ad235b8eedaa583ce991b92

SHA512
904ae1dc91e5315f05be5cd7239f3fc4d3702b8c78dfd93d76b64d1cc1d7051aa005de2c69e5a8654eae8131dbd3d80c66f6e33d7c8b097972285405a5799350

Download Submit
\Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

Filesize
469KB

MD5
a6a8f89250cdc734a163868a0f5cccea

SHA1
6ab06aaf1e795bc1a72c8095708568cf2d3bed38

SHA256
7868cec689ba10bb6d8a5a1abc0508183b817e5814fc504e090e104dd7d37483

SHA512
7991d28467ee0a896e304d18c7fc4caac9e9ac2f57198313d5688ddc68e22ae80447c92a097b5e4ed6ff86a90df607ff1ffa61c07082f85b5f222b07aa4a7ca2

Download Submit
\Users\Admin\AppData\Local\Temp\nst1640.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
memory/112-85-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/816-96-0x0000000000330000-0x0000000000332000-memory.dmp

Filesize
8KB

Download
memory/2356-44-0x0000000003620000-0x0000000003774000-memory.dmp

Filesize
1.3MB

Download
memory/2356-155-0x0000000003620000-0x0000000003774000-memory.dmp

Filesize
1.3MB

Download
memory/2516-159-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-169-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-52-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2516-45-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-153-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-181-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-156-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-157-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-179-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-161-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-163-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-165-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-167-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-48-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2516-171-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-173-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-175-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2516-177-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2796-74-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/2968-64-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download