3d75dcc7265c8323e4192ea8442c1354086def6b2893957a0bd61d8f90662b50

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91e49c7408a6c41f0d64682f56504a41_JaffaCakes118.exe
Size 224KB
Sample240603-qc2ejsfd8s
SHA256 3d75dcc7265c8323e4192ea8442c1354086def6b2893957a0bd61d8f90662b50
MD5 91e49c7408a6c41f0d64682f56504a41
SHA1 fffd906c1dfb11bebd71131fb713085698fd4d13
SHA512 d9285fd26d54439bd861ee3b633e60d84e60835d3f67de478803a543b5c11b4e86f36182977e06dd12ec6651897aaec7e1cf5a706a395424a3d1634792a29062
SSDEEP 3072:edLfTvCY5uNKITkMrI6/9FWsgN4Mn3mGpjYND0nnybAtQpdWzxhyRvOVGqrJ0jmk:edqTdIC9e7nWGpUNDM7WexhySGmJG/Bz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4740	ibili.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ibili = "C:\\Users\\Admin\\AppData\\Roaming\\Yfdute\\ibili.exe"	ibili.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 1076	4456	91e49c7408a6c41f0d64682f56504a41_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe
4740	ibili.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4740	4456	91e49c7408a6c41f0d64682f56504a41_JaffaCakes118.exe	82
PID 4456 wrote to memory of 4740	4456	91e49c7408a6c41f0d64682f56504a41_JaffaCakes118.exe	82
PID 4456 wrote to memory of 4740	4456	91e49c7408a6c41f0d64682f56504a41_JaffaCakes118.exe	82
PID 4740 wrote to memory of 2628	4740	ibili.exe	44
PID 4740 wrote to memory of 2628	4740	ibili.exe	44
PID 4740 wrote to memory of 2628	4740	ibili.exe	44
PID 4740 wrote to memory of 2628	4740	ibili.exe	44
PID 4740 wrote to memory of 2628	4740	ibili.exe	44
PID 4740 wrote to memory of 2648	4740	ibili.exe	45
PID 4740 wrote to memory of 2648	4740	ibili.exe	45
PID 4740 wrote to memory of 2648	4740	ibili.exe	45
PID 4740 wrote to memory of 2648	4740	ibili.exe	45
PID 4740 wrote to memory of 2648	4740	ibili.exe	45
PID 4740 wrote to memory of 2756	4740	ibili.exe	47
PID 4740 wrote to memory of 2756	4740	ibili.exe	47
PID 4740 wrote to memory of 2756	4740	ibili.exe	47
PID 4740 wrote to memory of 2756	4740	ibili.exe	47
PID 4740 wrote to memory of 2756	4740	ibili.exe	47
PID 4740 wrote to memory of 3432	4740	ibili.exe	56
PID 4740 wrote to memory of 3432	4740	ibili.exe	56
PID 4740 wrote to memory of 3432	4740	ibili.exe	56
PID 4740 wrote to memory of 3432	4740	ibili.exe	56
PID 4740 wrote to memory of 3432	4740	ibili.exe	56
PID 4740 wrote to memory of 3588	4740	ibili.exe	57
PID 4740 wrote to memory of 3588	4740	ibili.exe	57
PID 4740 wrote to memory of 3588	4740	ibili.exe	57
PID 4740 wrote to memory of 3588	4740	ibili.exe	57
PID 4740 wrote to memory of 3588	4740	ibili.exe	57
PID 4740 wrote to memory of 3768	4740	ibili.exe	58
PID 4740 wrote to memory of 3768	4740	ibili.exe	58
PID 4740 wrote to memory of 3768	4740	ibili.exe	58
PID 4740 wrote to memory of 3768	4740	ibili.exe	58
PID 4740 wrote to memory of 3768	4740	ibili.exe	58
PID 4740 wrote to memory of 3920	4740	ibili.exe	59
PID 4740 wrote to memory of 3920	4740	ibili.exe	59
PID 4740 wrote to memory of 3920	4740	ibili.exe	59
PID 4740 wrote to memory of 3920	4740	ibili.exe	59
PID 4740 wrote to memory of 3920	4740	ibili.exe	59
PID 4740 wrote to memory of 3984	4740	ibili.exe	60
PID 4740 wrote to memory of 3984	4740	ibili.exe	60
PID 4740 wrote to memory of 3984	4740	ibili.exe	60
PID 4740 wrote to memory of 3984	4740	ibili.exe	60
PID 4740 wrote to memory of 3984	4740	ibili.exe	60
PID 4740 wrote to memory of 4076	4740	ibili.exe	61
PID 4740 wrote to memory of 4076	4740	ibili.exe	61
PID 4740 wrote to memory of 4076	4740	ibili.exe	61
PID 4740 wrote to memory of 4076	4740	ibili.exe	61
PID 4740 wrote to memory of 4076	4740	ibili.exe	61
PID 4740 wrote to memory of 3952	4740	ibili.exe	62
PID 4740 wrote to memory of 3952	4740	ibili.exe	62
PID 4740 wrote to memory of 3952	4740	ibili.exe	62
PID 4740 wrote to memory of 3952	4740	ibili.exe	62
PID 4740 wrote to memory of 3952	4740	ibili.exe	62
PID 4740 wrote to memory of 4720	4740	ibili.exe	64
PID 4740 wrote to memory of 4720	4740	ibili.exe	64
PID 4740 wrote to memory of 4720	4740	ibili.exe	64
PID 4740 wrote to memory of 4720	4740	ibili.exe	64
PID 4740 wrote to memory of 4720	4740	ibili.exe	64
PID 4740 wrote to memory of 780	4740	ibili.exe	75
PID 4740 wrote to memory of 780	4740	ibili.exe	75
PID 4740 wrote to memory of 780	4740	ibili.exe	75
PID 4740 wrote to memory of 780	4740	ibili.exe	75
PID 4740 wrote to memory of 780	4740	ibili.exe	75
PID 4740 wrote to memory of 4620	4740	ibili.exe	80

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2648

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2756

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\91e49c7408a6c41f0d64682f56504a41_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\91e49c7408a6c41f0d64682f56504a41_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Users\Admin\AppData\Roaming\Yfdute\ibili.exe
    "C:\Users\Admin\AppData\Roaming\Yfdute\ibili.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CYBB81D.bat"
    3⤵
    PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3768

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3984

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4076

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3952

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4720

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:780

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4620

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:4424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1876

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CYBB81D.bat

Path C:\Users\Admin\AppData\Local\Temp\CYBB81D.bat
Size 267B
SHA256 02138fbf450594cc14f1585df283c7df35558209d6708a78d7a465b3f4295cf9
MD5 d32cc89d958bed5336f326188c14894e
SHA1 7d8cc3cd297755624d209e0d1330e142c18c95a5
SHA512 d79007e930a7027abef700f22e6057cbc05f4aef0b35678252d07d96afd849158352dd80694ad600a6944a2ac00f4cd014603df984c86fdd817fb9989d79aca1
MD5 SHA1 SHA512

Submit Download

ibili.exe

Path C:\Users\Admin\AppData\Roaming\Yfdute\ibili.exe
Size 224KB
SHA256 b0bba4ff70fdfc8535ad314546442bac4957f53b1bc6795b9a46ddc2d2a9a10d
MD5 9c686dfa95d847b0ce63718affd13119
SHA1 1a6ec7cfdacae995d40afdc74d2d5e7d04be0002
SHA512 a3df01b8572393c3b488b108b516f0b9826b853ad2c1522fb82c9c087fb980ad2dcd2f684e823c47625109a1df88c9c485b6203abe67aa38942baf3f820c5166
SSDEEP 3072:edLfTvCY5uNKITkMrI6/9FWsgN4Mn3mGpjYND0nnybAtQpdWzxhyRvOVGqrJ0jm7:edqTdIC9e7nWGpUNDM7WexhySGmJG/B8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1076-32-0x0000000000B80000-0x0000000000BC8000-memory.dmp

Download

memory/1076-40-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/1076-35-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/1076-43-0x0000000000B80000-0x0000000000BC8000-memory.dmp

Download

memory/1076-36-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/1076-37-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/1076-38-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/1076-41-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/1076-42-0x0000000000B80000-0x0000000000BC8000-memory.dmp

Download

memory/1076-39-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/4456-19-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/4456-22-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4456-23-0x00000000020D0000-0x0000000002118000-memory.dmp

Download

memory/4456-1-0x0000000000A40000-0x0000000000A49000-memory.dmp

Download

memory/4456-21-0x00000000020D0000-0x0000000002118000-memory.dmp

Download

memory/4456-20-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/4456-0-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4456-18-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/4456-17-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/4456-16-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/4456-15-0x000000006FFF0000-0x0000000070000000-memory.dmp

Download

memory/4456-33-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4456-14-0x00000000020D0000-0x0000000002118000-memory.dmp

Download

memory/4456-2-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4456-3-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4456-5-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4456-4-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4740-10-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4740-12-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4740-13-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4740-26-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4740-46-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4740-47-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4740-48-0x0000000000400000-0x0000000000449000-memory.dmp

Download