Overview

overview

10

Static

static

3

2ae7b95eed...18.exe

windows7-x64

10

2ae7b95eed...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2024 04:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2ae7b95eed8b2b517812b0de47d93656_JaffaCakes118.exe

  • Size

    284KB

  • MD5

    2ae7b95eed8b2b517812b0de47d93656

  • SHA1

    a043dddb9301629f85819585ad2d012e830bd9e6

  • SHA256

    45c6cdeb89a0daa6665bb53d298adbee1de0c4f7743fdc51bf23a0c197bb981d

  • SHA512

    14f79b63e21f0ad4f326c29bb5c9c24b8e3aa0689aa0c25d9fbec62aed5f2df4ce6dca6536b31e35e2b77383eb5c65a377769fb590cc5074dc2f3663257efdcd

  • SSDEEP

    3072:Hz5HjlrQBC8hrQNHjrKorFlEEeQ4ucmGRf1FokwzlmgIr:ljdQUiQ9jWoDEEO1mGR6R

Score
10/10
adwarepersistencestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ae7b95eed8b2b517812b0de47d93656_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2ae7b95eed8b2b517812b0de47d93656_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.avancn.com/tongji/count/count.asp?id=00-00-00-00-00-00&ver=1.0
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3544
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3544 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4444
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c regsvr32 /s c:\windows\system32\micsofthaha.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s c:\windows\system32\micsofthaha.dll
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:4188
    • C:\Windows\SysWOW64\autoups.exe
      autoups.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c color 0a
        3⤵
          PID:3912
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\autoups.exe > nul
          3⤵
            PID:4516
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a.bat""
          2⤵
            PID:548

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3MBDQR8B\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\a.bat
          Filesize

          218B

          MD5

          ab45f221304accd15c0f0dfcef501417

          SHA1

          5ef0efc7c4bc0b61f302ba342e4ce91a20e5bb34

          SHA256

          8b4bef5b32ec58473fcfa7ff84eaa2fb756e164863847c576fffbba61a708581

          SHA512

          429941eee58509a9835e41db8c75d0f9f75749aeca57e87e7c6e9c66968bc3baf0853164fd55b81b0ce011996c511979d3d6618dc3a5ac288f571d89c740ea3c

          Download Submit

        • C:\Windows\SysWOW64\autoups.exe
          Filesize

          160KB

          MD5

          75f255faef348b88141bb7c15689bd5a

          SHA1

          ff9cd9a807f8e4f46c55d6fe49e912d57aa2e55a

          SHA256

          8f35b33e1c7984a88ab9bdaf07d1fe3979ed478ba3e9973fafeb0f42ed3d5904

          SHA512

          b0782337583644b51d1391d6f01d79dacaea1bf2bf7ee17027be2f1c07ea39f360d9ccded5e78a5a463ec22a2b9942bf49c3033d95e1d15cd85c77bdc79de9cc

          Download Submit

        • \??\c:\windows\SysWOW64\micsofthaha.dll
          Filesize

          40KB

          MD5

          c29bf2f7e9e655d7505ba193561aba1f

          SHA1

          430401e8773d231ee298be083f830f0d0a68baba

          SHA256

          7b9563b6f7ceea4ffc22de8e1b8c29359226e31574d9c70f6565e6d50405c5ec

          SHA512

          3887dc637ae9b53d3673eaa81d98dc0b4604786ac87a1d3136ce41b53a938a4879911b8e8a24db9c0076e91683a65f9a3edd5e2ebec2b15d7cb407c2f38fd805

          Download Submit