Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 05:56
Static task
static1
Behavioral task
behavioral1
Sample
214d6295a7e2caeedbda5ed49e43a525_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
214d6295a7e2caeedbda5ed49e43a525_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$TEMP/BetterInstaller.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$TEMP/BetterInstaller.exe
Resource
win10v2004-20240508-en
General
-
Target
$TEMP/BetterInstaller.exe
-
Size
207KB
-
MD5
d79b88bab3231ebebd3c6505ab68ce56
-
SHA1
3222e8dab740ba1d640cc66a9cd36070969deb80
-
SHA256
d4032354c8ca3b93fd18414d6a7935bcecb18f25534b2259eeaf7d3081ec13ec
-
SHA512
b8afbd52e74d8611714a33bd80a907be8080195bd574ceb0aa8ce44520c9cf6c40ccce4a4db9be0808b8b5a6b7b0fee17ee42f9cca67d69152dd1f1d8ddd99a9
-
SSDEEP
3072:mQQVJ7raoxdBcJuAZ750rdOaq8GPquHKgtIwJID5E8hL4xZ2vyOJiRgV57vVsSIR:sV8oNkNNPygmVD5E+L4xKhzcFGe
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main BetterInstaller.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2168 BetterInstaller.exe 2168 BetterInstaller.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd68e162e498457805957fd67621cd6a
SHA1241722b160f62fbfdb388a1eca565bf189506322
SHA256a5e8062b6af56d57e7a16ee7058e527e8fe45e57661031f19f66bd97f6ed798b
SHA5125e64c1e1ba8da4fbfbea1d3956cbd05190694ead7f17688714f45ae961c8f8978d16e0da593a958b9fa36f6174188b52e25dbd0a895f5a04a104e7dde22dfa4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbc314282ce4ea6cb85a50e904569359
SHA1df5ad58caa5993680a44f3b609bcfbb415be3de0
SHA2562a2d4fcbebeee87967b08eded744f3e8727a8cd7fdff9647517a51a76c7e66fd
SHA512485370e284839277c1f13d408284667987331dfbd339b2d2849b42073bbb5d92a5d217a7a0aa6341b49c6c81ace78e04b8d567d908b6b76c60709eb8d8144b23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f058ca8e551633849c6881b00c88e1e
SHA167187ba1c4d4f0f4696652746468e6665661fd99
SHA256615d65ef0316e5d6c63a5ac46385ca8fa46c3b3c07eb8fbed99d96337d09d7e2
SHA512d4889e84a661f9fb43b7ec0b9269e3855a83dbd1cb7eb8b775f44b32ac320fd94704a675f3ee09d913d812a3f6b5ea089a21f2c4c38f9abd417b1ed90718557b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553e3463f712a126cb611e295a0a863b2
SHA1bd0598bbb17a6362256bd4d625802e34f2bef512
SHA256e98274f561f0845a98e8681a82bef6e856e00ec69e1a964a8353c117f257b1d4
SHA512a5e0a9caea6a60341a11b75a021e5ac0c3d02488ddb39464fea57fd704b78c3b27f51b809325c5ccb59d8cbbb65f7cabbc37c0baf62e2e63f81fdc4052be21e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfdf8d54a3a0efc8e7ea62277e9ee7d1
SHA189083229abca4cc0e7edf61ef2abcd01d4ebd9f2
SHA2569058e73c51aa0044116704b1ff98c13e82ca93727021ebecb7e5e9ae6f899fc8
SHA51277598617c9bbf5941bf7a5e5eea64c688869a89a94b8e0f72ccac9c2a1e9adbd9e2f34973ad7a8821537e70a961adf0767a04a6fad7fad0c24bfe38977daf90e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4018cd55eb621fd22837ef51199a0dd
SHA14c26e1fc41fdc8303b6cb40f0bd673f5a5541d0e
SHA256e9625a7d49fb8ce6a68f355f32a037491314c094f69a793bb54485b9ffc3b83f
SHA512fec380e55f767a442d9e2de669967fb6c2b0e864d8f9eb4f8e2e70add70555e6e2f05bac90f509b35c907e31fbb3571f339f87aefd9a87b4754618b65a87c5f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5270c24173d50c3c25c67c4ad95dca44f
SHA1044f97f074eaa293835538e4c98c29623c3a0d96
SHA256735f815960ebd662011a3013080f72041bd5e005ffd5caa40fce98347a5ad3df
SHA512366319a050db5991af5d7d3088226f2b8ce342abc7ed9e3dfc6d8fb4285c3e8cb6438d29526f8ed73352a214dde0e6c01984a4a4996fbe9b9e6ab6c616d9cb33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c20bf1d5d73510ea03bf8180c7202fc
SHA13e64c664e212bb7dfb3086f672e4bf3d68b240ea
SHA256ce786d1d078410f1884b4a5219d1623c8c80eb9a4490357b44ca559fe408747a
SHA512a0277ac9bd498109391922f7c7fbc9f988280685fa1b0f8d33d8f6e51e8f5bab76bfd334f38448e85e0699aff7561553c894a098c10d436d89fe489cbcb1d394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5883addcb42fab09d816cc518f4ed59da
SHA1c5474ef66c07ef282ccf4a1460415ed168f043e3
SHA2562ee5c23edab9ee6fa5f7537954685ea58d63ecd3507c5523a7ba399579234f32
SHA512b1137e362fd3b51836ac0f2e2e1445cf063d3928ed9276e6d779cc1cd5b2f1410813b431ecb9d0a491957702b15a4523d3cf29fcb3802afe6bcc6cf7b632c8d8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b