22968e0b3963e9801600518f6212ac92ca6c14a6e22ed24f292a82557dc642d2

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Size

28KB
MD5

18a2b33d115d3be7c8969d350823380c
SHA1

03fa33de9bcf6fd8c96233258428446a58b7f9ac
SHA256

22968e0b3963e9801600518f6212ac92ca6c14a6e22ed24f292a82557dc642d2
SHA512

01163fbd008fb0e3e46897c3000bff258b72cf3619c32403edf774a4f465b00a8ee75711af7a48d32798e6533a29189043667ea281871513be35c3ba06766dbf
SSDEEP

384:oGiZoqe4eI9vlAdWfVGPZ8URB8GmSKamkTCAoBZ4Rx4RPUfKlIiqPYS:oHOqe3I9vGdWuBvmTaDTMa2R8fjPYS

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,c:\\windows\\system32\\360ST.exe"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\360DJ.txt	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\drivers\360S.txt	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\drivers\360T.txt	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\drivers\360ST.txt	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\drivers\360DJ.txt	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2904	regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\360ST.exe	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\360ST.exe	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\360ST.dll	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\url2	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\tihuan5	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "0"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "5"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\url1	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\tihuan2	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "35"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\homepages = "http://www.baidu.com"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\url5	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\tihuan1	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\url4	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "5"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\chajianlm	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\ = "chajianlm"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "0"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "35"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\url3	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\tihuan3	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Desktop\chajianlm\tihuan4	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8"	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2164	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
2164	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
2164	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2364	2164	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe	29
PID 2164 wrote to memory of 2364	2164	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe	29
PID 2164 wrote to memory of 2364	2164	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe	29
PID 2164 wrote to memory of 2364	2164	18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2904	2364	cmd.exe	31
PID 2364 wrote to memory of 2904	2364	cmd.exe	31
PID 2364 wrote to memory of 2904	2364	cmd.exe	31
PID 2364 wrote to memory of 2904	2364	cmd.exe	31
PID 2364 wrote to memory of 2904	2364	cmd.exe	31
PID 2364 wrote to memory of 2904	2364	cmd.exe	31
PID 2364 wrote to memory of 2904	2364	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18a2b33d115d3be7c8969d350823380c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regsvr32 /s c:\windows\system32\360ST.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s c:\windows\system32\360ST.dll
    3⤵
    - Loads dropped DLL
    PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\TIWGXJYA\www.baidu[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Windows\SysWOW64\drivers\360DJ.txt

Filesize
400KB

MD5
5463411619140963272bcb825cfe9a6e

SHA1
ad8b2d403c9a8915ae2df7f852209ead3904d090

SHA256
128108da127f7824aa2f1c232771d486f3cbd5f9e806d035aa531735a065bc5a

SHA512
2e5fed24131f65a90063f60832c757d9835e3673db2aeed1bf010bcdad2204ef637b5bbdad6318d13264e8f7aae5c5843c7f31ad0112afb418cbd1b73151d0a1

Download Submit
\??\c:\windows\SysWOW64\360ST.dll

Filesize
27KB

MD5
a4958eeceddac41bf15551af8eff8d32

SHA1
f067872a5304e69f92034e5efb023145fd34b65d

SHA256
a8dfe56722f771e6f746b9a786ad9794cfb4a5478a5bde505a22ce5c97242c32

SHA512
39eb90956a2fe28a9bb8860de8c73bf62dcdb57af4a521fcf52715e3d37cf60cf6678e15f44b46bfe107c652de37990ba469dd40b752837e12e8e0ff3e42b4e3

Download Submit
memory/2164-17-0x0000000005390000-0x00000000057A2000-memory.dmp

Filesize
4.1MB

Download
memory/2164-24-0x0000000005FE0000-0x0000000005FF7000-memory.dmp

Filesize
92KB

Download
memory/2164-29-0x0000000006C90000-0x0000000006DC0000-memory.dmp

Filesize
1.2MB

Download
memory/2164-65-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2904-14-0x0000000011000000-0x000000001100C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads