Analysis
- max time kernel
149s - max time network
154s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 16:24
Static task
static1
Behavioral task
behavioral1
Sample
a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe
- Size 1.6MB
- Sample240613-twmmaazfml
- SHA256 8c6118146bda7b7f51946083e365ef66f122602eeca7b44559bbcf9f3e33c0f4
- MD5 a67b1993186041776a15ae97fcc99d36
- SHA1 cf6ad4a95908229ddc6ea5c2a85237092b349431
- SHA512 179b987507b3f76bbecb3723fff10501c990f3281e37f32942f7ba2f9131cdc028ce5558fcfae572c112565e2246a3954945de278bc04d59d7cc411c6e1c53ff
- SSDEEP 49152:K3/9v2ODvFzn2q//axPbzn4Cckb6cf30:kVvN9znV//8fn/ckGqE
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions OKS.exe - Executes dropped EXE 3 IoCs
pid Process 2680 picview.exe 2280 OKS.exe 1592 picbus.exe - Loads dropped DLL 15 IoCs
pid Process 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 1592 picbus.exe 1592 picbus.exe 860 WerFault.exe 860 WerFault.exe 860 WerFault.exe 860 WerFault.exe 860 WerFault.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2280 OKS.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\2.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\Unins.exe a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\msvcp100.dll a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\window_popup_pass.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\3.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\FrmAdvert.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\FrmTrayMenu.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\bar_btn.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_close.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\7.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\9.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\picview.exe a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\bar_bg.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\11.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\tongjiData.ini a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\OKS.exe a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\OKS.exe a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\bar_btn.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\popup_s.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_mini.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\FrmTrayWebAD.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\WinFileMenu.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\TPSC.dll a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\SysConfig.ini a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\FrmTrayMenu.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\btn_close1.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\logo.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\popup_s.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\0.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\FrmAdvert.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\picview.exe a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\DuiLib_u.dll a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_mini.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\10.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\4.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\4.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\WinOperMenu.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_max.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\window_popup_pass.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\11.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\picbus.exe a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\WinFileMenu.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\0.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\1.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\10.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\img.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\FrmTrayWebAD.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\Data\tongjiData.ini a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\window_popup.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\5.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\5.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\img.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\tongjiData.ini a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\logo.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_max.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\8.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_default.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\2.ico a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\btn_close1.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_close.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\window_btn_default.png a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\picview_202406131624\202406131624\data\WinMainFrame.xml a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\picbus.exe a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe File created C:\Program Files (x86)\picview_202406131624\202406131624\DuiLib_u.dll a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 860 1592 WerFault.exe 32 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main picbus.exe - Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\Shell\ = "Open" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\Shell\Open picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\Shell\Open\Command\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\picview.exe \"%1\"" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\Shell\Open\Command picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jpg picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\Shell\Open\Command picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\Shell\Open\Command\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\picview.exe \"%1\"" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\DefaultIcon\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\Data\\img.ico" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jpeg\ = "PicView.jpeg" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\Shell\Open picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\Shell\Open\ = "使用图片查看器打开" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\Shell\Open\ = "使用图片查看器打开" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.bmp\ = "PicView.bmp" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jpg\ = "PicView.jpg" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\ = "PicView.jpg" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\ = "PicView.jpeg" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.png picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\ = "PicView.png" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\DefaultIcon picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\Shell picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\ = "PicView.bmp" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\DefaultIcon\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\Data\\img.ico" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\Shell\Open picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jpeg picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\DefaultIcon\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\Data\\img.ico" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\Shell\Open\Command\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\picview.exe \"%1\"" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\Shell\Open\ = "使用图片查看器打开" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\DefaultIcon picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\Shell\ = "Open" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\Shell\ = "Open" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\Shell\Open\Command picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.bmp picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpeg\Shell picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.png\ = "PicView.png" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\DefaultIcon\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\Data\\img.ico" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\Shell picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\Shell\ = "Open" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\Shell\Open picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\DefaultIcon picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\Shell picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\Shell\Open\Command picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.jpg\Shell\Open\Command\ = "C:\\Program Files (x86)\\picview_202406131624\\202406131624\\picview.exe \"%1\"" picview.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.png\Shell\Open\ = "使用图片查看器打开" picview.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\PicView.bmp\DefaultIcon picview.exe - Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe Token: SeDebugPrivilege 2280 OKS.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2680 picview.exe 2680 picview.exe 1592 picbus.exe 1592 picbus.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe 2680 picview.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2680 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 28 PID 2476 wrote to memory of 2680 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 28 PID 2476 wrote to memory of 2680 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 28 PID 2476 wrote to memory of 2680 2476 a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe 28 PID 2680 wrote to memory of 2280 2680 picview.exe 31 PID 2680 wrote to memory of 2280 2680 picview.exe 31 PID 2680 wrote to memory of 2280 2680 picview.exe 31 PID 2680 wrote to memory of 2280 2680 picview.exe 31 PID 2680 wrote to memory of 1592 2680 picview.exe 32 PID 2680 wrote to memory of 1592 2680 picview.exe 32 PID 2680 wrote to memory of 1592 2680 picview.exe 32 PID 2680 wrote to memory of 1592 2680 picview.exe 32 PID 1592 wrote to memory of 860 1592 picbus.exe 35 PID 1592 wrote to memory of 860 1592 picbus.exe 35 PID 1592 wrote to memory of 860 1592 picbus.exe 35 PID 1592 wrote to memory of 860 1592 picbus.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a67b1993186041776a15ae97fcc99d36_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\picview_202406131624\202406131624\picview.exe"C:\Program Files (x86)\picview_202406131624\202406131624\picview.exe" -tuopan2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Program Files (x86)\picview_202406131624\202406131624\OKS.exe"C:\Program Files (x86)\picview_202406131624\202406131624\OKS.exe" -W3⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Program Files (x86)\picview_202406131624\202406131624\picbus.exe"C:\Program Files (x86)\picview_202406131624\202406131624\picbus.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 13044⤵
- Loads dropped DLL
- Program crash
PID:860
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\picview_202406131624\202406131624\Data\FrmAdvert.xml
- Size 185B
- SHA256 28e029c2f5fa029d277a7f91d4919900ba5bafa2e8608c3e74aa0c0b15cb97d5
- MD5 baa8fe197cdaa706040f8fe6e9bfdd5a
- SHA1 abdd19436a2bfbfd8eca5f98d0967da3a03aebb6
- SHA512 742ba460245885350890048e2c060fe14730f2a1e05ae8a08f751f67e605f2b36e4507ae51463510ff25db0539d0bb00dd42ce37b8199dca59cd1ee7b58e6f78
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\picview_202406131624\202406131624\Data\FrmTrayWebAD.xml
- Size 682B
- SHA256 a224f80f0554104d29e43627413a65bcd01c02eab10404da93bb593120012d48
- MD5 a8ea7aea881d2d60ec71981a9da00d18
- SHA1 128f43c0b6912dd75b90002f0f8df1cdb72c5788
- SHA512 a5dc7efbb9c8b33e73f550e0125807ca47aa0a9f766705df975fe66325e009daa2a73eccb51671067af39133fd2d1ca5c255a6a07637a9ea71baed3277aac559
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\picview_202406131624\202406131624\Data\WinMainFrame.xml
- Size 2KB
- SHA256 ee8e4b02157b8176a56c358285f82ee36a12be29eaaf6c9dd77efc30b1674a62
- MD5 9ed93f68181149be6b8d65e36e80c45b
- SHA1 78c274501f401cceb4ed7ac808e6b0c151c10992
- SHA512 e05cb02bdfe0d2bbd91da87c633202bb906c58282d7d28d518a274e8ae5445da6231f641f36ad086a938618d8850df80715f8a6ce8b7b16af9cb850634743f36
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\picview_202406131624\202406131624\Data\tongjiData.ini
- Size 112B
- SHA256 960fa9cc7df516ee5184f8e03edd55cbe3f4ca85fac4f12064c8db2c78848d84
- MD5 f575cd5772146f3ff7611318e57bbf7b
- SHA1 8cd917ada6407e5dc707ecdfa6477b554effdc01
- SHA512 0d4b3df4848b2f05f311f2cdd9df2bf061306ac2879614e7a30c62c39a43613e50816fc6d94edb65d1789ce445e78a26567d9de5c700a2fd1f618d9e0ef7c75b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\picview_202406131624\202406131624\DuiLib_u.dll
- Size 401KB
- SHA256 c919175dfc6ad57f8b0b38e2c3f8958bfe1ff257cfb356ea0e6613011ab57498
- MD5 76d4bc26590d19697eef4ad49da5d9dd
- SHA1 8c48f4305eac73d44860432d3b43a1d5c9d554af
- SHA512 da6e92ffcbf389f6ab54701e01f3b18c6cda5951bf7a2df7c3ba0de153fd8e515666f9fdb4b5b8f413c041c869117bc1f4a140f6c6f2bb0c7c9709d24bf4d02a
- SSDEEP 6144:JiwswMtYfW9TWdlXcABMqZ5TInJpSEcvQL0ekOnF/aMS:0wSGqxAB+sve9yM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\picview_202406131624\202406131624\MSVCP100.dll
- Size 410KB
- SHA256 d2f6b30e507bfa6294cd588abcb52645fee069d5f38fedc1bce93e2a06056274
- MD5 fa78eacffbbd98eaabe96a7eff1849b5
- SHA1 436bb4e01193a4518e458132ec6f107dc7a79b41
- SHA512 29040d415fc3a64b3f5065c7b6131297170e7fbc2f565eeb689765eec90324c0ff79267a9707d1c7a2cd94043e6f5e5216da797c03b22182bb090e7f4ae202d6
- SSDEEP 12288:1eb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7:1eb8Fpa6aHX7dGP5Gv3Ooc8UHkC2e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\picview_202406131624\202406131624\MSVCR100.dll
- Size 754KB
- SHA256 6f0ce2263db465bd4443534cee1c647dfe86e2684dd5609755d7d330788e733c
- MD5 7e52465b8e9c0cfc90bd5a03a5394c7d
- SHA1 dc6c6812bfc6f0f68407baa710df3edafb5a3f40
- SHA512 789fcdef95a8c7da50589517bd8c4ff98d1894be027e5e50b18f3ab5e432b7bae450ae98e1dca41cae3cfc7de8e3c950e672774f12f2f3941635e362e57bf7f3
- SSDEEP 12288:WMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe:BmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\picview_202406131624\202406131624\OKS.exe
- Size 373KB
- SHA256 b998495310e3d81eeaf3a9d5d1edd686810a6927c6acec7ed19f570cffcb6f9c
- MD5 6b9faed50882703fd27bef513369a57c
- SHA1 35724212311766d52b2e5fc3e45b3e1982b62226
- SHA512 277d5ab2b90bbd8d91c118e5bb834723795038eca76d601116823341f2a932d6d13fd9d6c420c8d60dc93d7eb979fb50253bb50cb0310ae27f2448a206f9fb49
- SSDEEP 6144:SlFSFlIPJ3RWeh6owj6ScZhVmKyUEzk6u1G20YGqiV72IwQhmFohq+pRNG67L:SLTxR/2j6FZhVmrUEYfI2PMh2VMmX+nt
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\picview_202406131624\202406131624\picbus.exe
- Size 171KB
- SHA256 d3a4c6cd6652f48be4f08b3fc82f1351aeb9b9665a4bf84afc20fc8f5155a021
- MD5 380680c186797bba0192e6eb709ea164
- SHA1 f766e0a036ae36ee8f4d77390c6640ff8d550dba
- SHA512 3665edfaf8e47d04f91c764fe10b7d510e7fe4fee0b59a21ff8cfa853b93508a3b03a9afecd8ad5d244645de8fb413d7868beccd53071a8df435be558d13b8f8
- SSDEEP 3072:xyJ9cUDoTEp59OZgZ4n/mwn0dF8PpEyHBZcz7DOK7TAB2g+e:Ac8oKkmKPp3Zcz7DOK7lg
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\picview_202406131624\202406131624\picview.exe
- Size 582KB
- SHA256 50aaaebe0b360b059534e5a6c7f8fea34357a9ce6dff07851a07a7015df45855
- MD5 017e6b9dc5038f268cf41c3c8245be34
- SHA1 d184b18a033652c48f975ed3b98fc6df24bba10f
- SHA512 1bf4bbdca2a823af8817d5f84764def2b3d85bffa59b010a475615c1dd0ff82adc2d564f32052447ba2d7828b2a4fb63f5162c4062b45d9397cfba1d07481200
- SSDEEP 12288:G7Q/DjkPsDRheZ4iQa4Jrcw6CVv6iLakpImrRLkGK3Wv9xwa:G7Qrjk0DRheZ4iQa4J4Ev6sakpImrRLZ
- MD5 SHA1 SHA512 SSDEEP