Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 07:34

General

  • Target

    0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe

  • Size

    244KB

  • MD5

    0411fbf6288de3e978aefd69af73d00e

  • SHA1

    810344528cdf8b82cb9f9694ac607690c36961f8

  • SHA256

    c3b38963d437f369539cd22a21f83105f2febb99dc6feb30434f2f0bbb2f5d42

  • SHA512

    35ca2b2e6d7fa3de002d831d2de2fc64a4bb87181610f6760c83105e2f5edbd68a4004f864784fe1ca8ba4f4d0ce2034dbcd541fc8d011ab26a3724dd20ee772

  • SSDEEP

    3072:exBcTBPt+MxJwVEi/8HAuPX6HGJfKV2DVLoF4x7H9PoST:MBEBl+ywVEi/8HAuiHCftDVLoF4B9hT

Malware Config

Signatures

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0411fbf6288de3e978aefd69af73d00e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_212.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s /c C:\Users\Admin\AppData\Roaming\PIPI\pwdedit.dll
        3⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies registry class
        PID:4488
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4084
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\1.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\PROGRA~1\INTERN~1\iexplore.exe
          C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWW.cnkankan.com/?82133
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4304
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4304 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4704
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\1.inf
          4⤵
            PID:4552
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\2.bat
            4⤵
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:2108
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?n"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:1928
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?n"" /f
              5⤵
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              PID:4192
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?n"" /f
              5⤵
                PID:4692
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
                5⤵
                • Modifies registry class
                PID:956
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\datread\3.bat""" /f
                5⤵
                • Modifies registry class
                PID:1548
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:1524
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp
                5⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:4004
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\2.inf
                5⤵
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:1720
                • C:\Windows\SysWOW64\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  6⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:2772
                  • C:\Windows\SysWOW64\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    7⤵
                      PID:4696
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32 D:\VolumeDH\inj.dat,MainLoad
                  5⤵
                    PID:1356
            • C:\Users\Admin\AppData\Local\Temp\inl9632.tmp
              C:\Users\Admin\AppData\Local\Temp\inl9632.tmp
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl9632.tmp > nul
                3⤵
                  PID:1744
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0411FB~1.EXE > nul
                2⤵
                  PID:4656

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                Filesize

                471B

                MD5

                a20dcdd581a69f44e7dcbeeab5084fb4

                SHA1

                61e152b89ab8a04af1843bbfee557d193924ec51

                SHA256

                009768e52ded8da33ac7d96d521e882eef9765278997f2ce47311f637696d9c7

                SHA512

                77de84bf9c5480e704991bc16d8f555dc10891e3a5a7044fe2b133cc49d20ebb78c68bbdd4c9a4acd8e7424bce28a00bd3651f3b852a2a726f3f879a741cc7ae

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                Filesize

                404B

                MD5

                4183511f7d29c327554ca842efdaa95a

                SHA1

                64aa116f0dd3be496d12cd7f9b34d976e6b16ac9

                SHA256

                71b81fc01d22bcbd6690d59380be0e67319f0effeddbd0e5d29c198681a5376c

                SHA512

                36240143646f6836658c33c52103dd943b42f0f3c0de36741adbc4b61e8a407353741081950fc0f4c3dabfbb901a2e10aeca362bc58ca8b1a8f1455aeab38eaa

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\favicon[1].htm

                Filesize

                803B

                MD5

                9a56669fda653d180272060c91a1e932

                SHA1

                d5fd0bd68300df626aaad370ad96912f2edd3cf6

                SHA256

                37aa151bf0fc859681e856a3dad384f2344b542546e71d080ed7ac31abd79ac8

                SHA512

                e6a81e5e02a49a744ab62505d3d765a44f246c572f10b032a8e8137aba8b3f0c930ae8f5790c7104c0d1b4bfb9d5282363479954339758f932811260106ae6e1

              • C:\Users\Admin\AppData\Local\Temp\360mohesetup.exe

                Filesize

                794B

                MD5

                1bc415b31cdff50d79ea2a3d7b4ff2c1

                SHA1

                f5ebab61deebc3d7a4a6676a23b982f1418ae6a6

                SHA256

                582ea6421c80adc1de2dcb34fb8db1926e34b49219d99306693166a6b268d412

                SHA512

                ee9718e829fa7c6b2e3b208fe99acd390d704a4ad037fd9b5ae231db184f48146792fb1ac028a69224ddca2c3195ef2aa5353ee6bc7abe01157773f4a6e50e84

              • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

                Filesize

                858B

                MD5

                d727e34e3f5eb5ee1ce17fe4c66bf617

                SHA1

                ea796e8b305510775d244f30758e125a01569626

                SHA256

                d0cd1c2b674ee72b000ecacb181addd7735f4c3478731c23f4649e312e4c607d

                SHA512

                ae3028364bf02b3e7c78d7a44a3305537c16d7feefb9dd968296b86425babaccee81af0c40eb7f8f374266df0e2c3c1a08b6b951ceaddc55572d6f0f1e85705c

              • C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat

                Filesize

                54B

                MD5

                5dd457b845e53fce36e6b543764337e4

                SHA1

                eb7f8ce82274afa5702b20eb5ba133bb71bcb8d6

                SHA256

                0a2c605c32f2e9b3eda6f18df3d8c1fc2d87922b9bb23d6c3a9de3aa3f383992

                SHA512

                0fea97ddf333c178ca4805fc85f8b66f81a7906d1cc7bf440206aff50cc711643e90115f046077a323b3cc78deeb704f7eb8a934d0a1cd011f6a3ad67057c9f6

              • C:\Users\Admin\AppData\Local\Temp\glk_300_212.bat

                Filesize

                62B

                MD5

                f33f30c3cddbb32ce1641f7aa325a170

                SHA1

                dcaa649892d9acf11658bb7b85ae63b76d36a4a8

                SHA256

                efc90ad2a6161fb21977815aeb81095e82572a40a2b3ab69cd1abad04c6bc23d

                SHA512

                d07d64eaf8cee948de2099fc791f79a5b6a58529c760bd3f3105d2689708930026a54b3b27c0e55bbf4b3356ff9c8bd915704e80af7735a865bcf4a9abcadf79

              • C:\Users\Admin\AppData\Roaming\PIPI\pwdedit.dll

                Filesize

                5.8MB

                MD5

                a2d0b95eecec0b13e4b2d111223feca8

                SHA1

                a63fc5419566a870d8bcb2a4c9c8423bbbac9633

                SHA256

                aae54e202188e015109535d4c670b9bf0a4e0c67d8f7582347683c47fe991ac9

                SHA512

                dc766c5b6496cb449f82d07e68a04804dd52aed9c78b374d1c7bca3bce5d28fe99f9274f814aacd9a4ddf6323954b7fe60a8d8747452cbb7afef2bcc878a5fe9

              • C:\Users\Admin\AppData\Roaming\datread\1.bat

                Filesize

                3KB

                MD5

                e580af507ea9f91de910e0c11b1e5ff1

                SHA1

                998ed9fad171139fca6e0da98f660417fb87fc1c

                SHA256

                7ab3f848e819dbfe653558a517b6bcd0274040d4e5a0a74e1556916aa5f9d356

                SHA512

                240d3ed95def600a7b6da7b4ec9f0d2289471d7c96c8bff7198b33d55671004e3b7ad500935d9bd8b7d1cc08ad648b05f1b21c4e958542ac6a150dc3dd4797ab

              • C:\Users\Admin\AppData\Roaming\datread\1.inf

                Filesize

                410B

                MD5

                66a1f0147fed7ddd19e9bb7ff93705c5

                SHA1

                9d803c81ea2195617379b880b227892ba30b0bf6

                SHA256

                4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

                SHA512

                cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

              • C:\Users\Admin\AppData\Roaming\datread\2.bat

                Filesize

                3KB

                MD5

                7c54db0864c2eb965c63c3dfe6be2256

                SHA1

                303c5edaa7ec4530f88484e3c48ff7e674a676d1

                SHA256

                1886e568662fcc552a91c3ab25b86e5243032d4f43fa45ffb51c57ca533c4b91

                SHA512

                60677e5762c2a267269ca520f554b800e88ce80bd96479b0ab02ea9eded76332657c3c9b93961c47551bdea3feda4b1dd88e58ebd087ae42a7853fd4bf0b8997

              • C:\Users\Admin\AppData\Roaming\datread\2.inf

                Filesize

                248B

                MD5

                c5eaacddf7fe93d130f1eb67f3fc2d9d

                SHA1

                ce20a3a2d9925fa4672884ffda2ee200c06ad7ce

                SHA256

                c740a578ef5867e18bc914ef724c8258a324b4f35591690e91329a10d17f6b45

                SHA512

                1f9529123cf74f1c53f75d81b9b6dabb127fcef0067c104c5ca044e28450083fa379c256d63d07d4e4053f197c24e02f9e2ab4507f8bb1068032598b52bbbf77

              • C:\Users\Admin\AppData\Roaming\datread\4.bat

                Filesize

                5.8MB

                MD5

                2cf4a3654b953935b844502c52715ee5

                SHA1

                b1c2b34458f8230336a943928a2f1919216855bd

                SHA256

                c085020d2e90f29b1d3192419f55fd8297181a09d32ad4bc042ea84ebfa4d9b3

                SHA512

                e563b71109228832f9260d6af9e6b837e2ec040ab9230a25fde54a347b619587da49ebda592bcf7d4f578185301a5c3ae4af37417312fad1ce7d304b2bc8036b

              • memory/2212-128-0x0000000000400000-0x000000000043D000-memory.dmp

                Filesize

                244KB

              • memory/2212-0-0x0000000000400000-0x000000000043D000-memory.dmp

                Filesize

                244KB

              • memory/4304-73-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-105-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-83-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-91-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-92-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-93-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-90-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-89-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-77-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-88-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-86-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-84-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-79-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-78-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-75-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-74-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-72-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-70-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-68-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-95-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-96-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-101-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-97-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-102-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-104-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-81-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-106-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-111-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-116-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-121-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-123-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-120-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-118-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-117-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-69-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-65-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-66-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-67-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-158-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-159-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-160-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-163-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-165-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-164-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-166-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-162-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-49-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-45-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB

              • memory/4304-43-0x00007FFAF6300000-0x00007FFAF636E000-memory.dmp

                Filesize

                440KB