Overview
overview
10Static
static
3a454cf45f1...18.exe
windows7-x64
10a454cf45f1...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Cdx.exe
windows7-x64
9Cdx.exe
windows10-2004-x64
9Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Two.vbs
windows7-x64
6Two.vbs
windows10-2004-x64
6enigma_ide.dll
windows7-x64
1enigma_ide.dll
windows10-2004-x64
1enigma_ide64.dll
windows7-x64
1enigma_ide64.dll
windows10-2004-x64
1udis.dll
windows7-x64
1udis.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 07:02
Static task
static1
Behavioral task
behavioral1
Sample
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Cdx.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
Cdx.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Setup.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Two.vbs
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Two.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
enigma_ide.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
enigma_ide.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
enigma_ide64.dll
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
enigma_ide64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
udis.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
udis.dll
Resource
win10v2004-20240611-en
General
-
Target
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
a454cf45f16ce0a03a2656fcdc05df63
-
SHA1
a1ab92e80ba89a9e285c52909c1aaadd337baceb
-
SHA256
49febd721b50c554167b59bc876a1a261896822096e39357e67cf9ef9dbaaae4
-
SHA512
3a9ffdffedae0a34d8dd6f43be94a0455505076ed0515b47d42c93b19ba95f39cdf71618de74119e21fba1df89895edc2c93dd45d46743a72462c1865760748d
-
SSDEEP
98304:6FSlDLW2AYidomeDyekTVEUF/1bE0OFi2i+GR1ZUl2tfi3eDDJyA1f7Zj:AaLhGTeDMTyUrbE0D5+M02weRyAF7F
Malware Config
Extracted
cryptbot
nife04.info
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
Setup.exeCdx.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Cdx.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup.exeCdx.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Cdx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Cdx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe -
Executes dropped EXE 2 IoCs
Processes:
Setup.exeCdx.exepid process 4420 Setup.exe 2436 Cdx.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Setup.exeCdx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine Setup.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine Cdx.exe -
Loads dropped DLL 2 IoCs
Processes:
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exepid process 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Setup.exeCdx.exepid process 4420 Setup.exe 2436 Cdx.exe -
Drops file in Program Files directory 7 IoCs
Processes:
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\Der\Supr\Cdx.exe a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe File created C:\Program Files (x86)\Der\Supr\enigma_ide.dll a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe File created C:\Program Files (x86)\Der\Supr\enigma_ide64.dll a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe File created C:\Program Files (x86)\Der\Supr\udis.dll a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe File created C:\Program Files (x86)\Der\Supr\Setup.exe a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe File created C:\Program Files (x86)\Der\Supr\Two.vbs a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe File created C:\Program Files (x86)\Der\Supr\Pass.txt a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exeCdx.exepid process 4420 Setup.exe 4420 Setup.exe 2436 Cdx.exe 2436 Cdx.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
Setup.exepid process 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe 4420 Setup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exedescription pid process target process PID 2444 wrote to memory of 4420 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe Setup.exe PID 2444 wrote to memory of 4420 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe Setup.exe PID 2444 wrote to memory of 4420 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe Setup.exe PID 2444 wrote to memory of 1184 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe CScript.exe PID 2444 wrote to memory of 1184 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe CScript.exe PID 2444 wrote to memory of 1184 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe CScript.exe PID 2444 wrote to memory of 2436 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe Cdx.exe PID 2444 wrote to memory of 2436 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe Cdx.exe PID 2444 wrote to memory of 2436 2444 a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe Cdx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Der\Supr\Setup.exe"C:\Program Files (x86)\Der\Supr\Setup.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\CScript.exe"C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Der\Supr\Two.vbs" //e:vbscript //B //NOLOGO2⤵
-
C:\Program Files (x86)\Der\Supr\Cdx.exe"C:\Program Files (x86)\Der\Supr\Cdx.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Der\Supr\Cdx.exeFilesize
2.0MB
MD5eb57e84905bea5e75e717d0edb58a8b6
SHA1fbd7ed1a3a2c6ed09ddd3675d5b3711b02cc1c02
SHA256d6a9b164f3e3faa8d75a28f519682d11829a8975f5a88b1357de88a253b67187
SHA512728b034d71f40ae2afd06058b88755752233d78c73518ef75f08e353f6d8deaee308a93a312dba0e249590019245d848c724481e9333df71ec062f00b0e26727
-
C:\Program Files (x86)\Der\Supr\Setup.exeFilesize
2.2MB
MD5282e9b884ace169eb8d641e65a570910
SHA1a14f8ae9158cbd7032cc177a25d7d952bb85b363
SHA256a664ad37a7cdbf3f0b1bc9aa46f4d5a945cc4f65f30f1782de15b67c8cac26cc
SHA5121dada2b0fc93ff8e6c2611d59e32c725bd008add73575aa0ae69a195beb69b9df2949e082990dcf9856542693fe5998e8deed366ed4fd136e5b39f36e7221249
-
C:\Program Files (x86)\Der\Supr\Two.vbsFilesize
126B
MD5c6362e3c5585f24a9e9a2712c00c52ff
SHA19259b9609313386f004328d2c306820eae01a587
SHA256184ca5b2737175e0828f3546d483778c95e23720f1375deac0090c2fe415e208
SHA51259ac94fdb6f41d6dc5cbea1855897759f35032ac922b936a0b39a21b6aafb0c862c5d419afa31c0b81f106f2ce06b2909cdb5fb713534fbe36202c5a4fedfeaa
-
C:\ProgramData\GLKtSJDMx2ya\Files\Browsers\_FilePasswords.txtFilesize
3B
MD5ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA157218c316b6921e2cd61027a2387edc31a2d9471
SHA256f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
SHA51237c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
-
C:\ProgramData\GLKtSJDMx2ya\Files\_Info.txtFilesize
7KB
MD5fdfec54f7d8938878c97a04568e0521d
SHA195b5280c9c2ea831ff9d50f97c2df9dbda0a388b
SHA256102ccf33a18ace66d1f3451a0d1f3329b765c41a836fe5f1cf9d74b6b3ae2f18
SHA512d376b579c89083fa5efc8995152e84afb185967505092324478a8af530ebbc3b9084c908d6fd9909824ecaefe78d6c9e58fe6dd947d2de06db47fb15f0461534
-
C:\ProgramData\GLKtSJDMx2ya\iKfKsyWqMfGZtcY.zipFilesize
49KB
MD58cb414b29b54db0963609228f4aede23
SHA1de2fa673f62b4e2db956f55734ee2e25f343a863
SHA256b02fd8e2a25e45a85d24cf99227bfffdcb6ce20f9239cd70d8c0574f2bbfe713
SHA5123a31baa02022ae192cc90de2b2242c5275beb4a4d89725c8daf720e4a3737396d8cc83f62fe0b4b7660e2e5b209e835557ce377e65d1b2055e4abb38470e0d2b
-
C:\Users\Admin\AppData\Local\Temp\nsp4622.tmp\UAC.dllFilesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
C:\Users\Admin\AppData\Local\Temp\nsp4622.tmp\nsExec.dllFilesize
6KB
MD5132e6153717a7f9710dcea4536f364cd
SHA1e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA256d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
SHA5129aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
-
memory/2436-307-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-294-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-313-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-316-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-304-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-301-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-298-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-309-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-319-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-322-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-153-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-324-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-289-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/2436-286-0x0000000000400000-0x0000000000918000-memory.dmpFilesize
5.1MB
-
memory/4420-285-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-306-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-283-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-288-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-272-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-291-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-150-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-293-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-149-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-296-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-146-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-300-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-130-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-303-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-66-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-284-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-23-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/4420-308-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-24-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/4420-312-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-25-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/4420-314-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-26-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/4420-318-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-27-0x00000000007B1000-0x0000000000813000-memory.dmpFilesize
392KB
-
memory/4420-321-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-22-0x0000000077184000-0x0000000077186000-memory.dmpFilesize
8KB
-
memory/4420-323-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB
-
memory/4420-20-0x00000000007B0000-0x0000000000CF6000-memory.dmpFilesize
5.3MB