b3dcd404cce492dae777a25032f03a7cf854e5363f6bbda0a1dce67996403fd9

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe
Size

294KB
MD5

3c2781dd8949a058ec528f814c2d7d3d
SHA1

4d23d235d5b23b665f8a27002dca285a2eb6b86f
SHA256

b3dcd404cce492dae777a25032f03a7cf854e5363f6bbda0a1dce67996403fd9
SHA512

abf925f2e65873ad6f2645bc7fd2c076fe38f64195da47585421833fce87a3b420156e61dbe438edc69ff424012e11cffc9c7055ea4e7ecda3fcf15a34930fe3
SSDEEP

6144:AZIRo4dsnj6/y47qBRKQ+9q6HPtNygzG9zrlW1bTqlh/C:AqKUsnDBR1+9q6vmg0zr0pTqlh/C

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
540	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1096	moegeg.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\{1B0C4E28-6E66-AD4F-AB1D-A71BBF328406} = "C:\\Users\\Admin\\AppData\\Roaming\\Yqlyvy\\moegeg.exe"	moegeg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2528 set thread context of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Privacy	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe
1096	moegeg.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe
1096	moegeg.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1096	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1096	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1096	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	29
PID 2528 wrote to memory of 1096	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	29
PID 1096 wrote to memory of 1152	1096	moegeg.exe	18
PID 1096 wrote to memory of 1152	1096	moegeg.exe	18
PID 1096 wrote to memory of 1152	1096	moegeg.exe	18
PID 1096 wrote to memory of 1152	1096	moegeg.exe	18
PID 1096 wrote to memory of 1152	1096	moegeg.exe	18
PID 1096 wrote to memory of 1232	1096	moegeg.exe	19
PID 1096 wrote to memory of 1232	1096	moegeg.exe	19
PID 1096 wrote to memory of 1232	1096	moegeg.exe	19
PID 1096 wrote to memory of 1232	1096	moegeg.exe	19
PID 1096 wrote to memory of 1232	1096	moegeg.exe	19
PID 1096 wrote to memory of 1280	1096	moegeg.exe	20
PID 1096 wrote to memory of 1280	1096	moegeg.exe	20
PID 1096 wrote to memory of 1280	1096	moegeg.exe	20
PID 1096 wrote to memory of 1280	1096	moegeg.exe	20
PID 1096 wrote to memory of 1280	1096	moegeg.exe	20
PID 1096 wrote to memory of 844	1096	moegeg.exe	22
PID 1096 wrote to memory of 844	1096	moegeg.exe	22
PID 1096 wrote to memory of 844	1096	moegeg.exe	22
PID 1096 wrote to memory of 844	1096	moegeg.exe	22
PID 1096 wrote to memory of 844	1096	moegeg.exe	22
PID 1096 wrote to memory of 2528	1096	moegeg.exe	28
PID 1096 wrote to memory of 2528	1096	moegeg.exe	28
PID 1096 wrote to memory of 2528	1096	moegeg.exe	28
PID 1096 wrote to memory of 2528	1096	moegeg.exe	28
PID 1096 wrote to memory of 2528	1096	moegeg.exe	28
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30
PID 2528 wrote to memory of 540	2528	3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe	30

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1152

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1232

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1280
- C:\Users\Admin\AppData\Local\Temp\3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3c2781dd8949a058ec528f814c2d7d3d_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Roaming\Yqlyvy\moegeg.exe
    "C:\Users\Admin\AppData\Roaming\Yqlyvy\moegeg.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4b748711.bat"
    3⤵
    - Deletes itself
    PID:540

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4b748711.bat

Filesize
271B

MD5
68062fa543d6b4850c82c4bebd1a0374

SHA1
366e2cac745d30610f2fa7eb0620622cd7baf36e

SHA256
f8ddb38f620ef33d0921824031f43c4c9ecd0f0cbec824905fe1c6bbd5452b2b

SHA512
4fe4ed8c0077065e895a91879b7a7b283f2811348e0eb05d337284989da6201fb6f4af152c5c8c8825715c4ae23f3accc41c9415862ba77e2fdc299d4bdb904d

Download Submit
C:\Users\Admin\AppData\Roaming\Yqlyvy\moegeg.exe

Filesize
294KB

MD5
9a9556e963a5736e2bf6c2dae5153cb6

SHA1
5eeff2f0398476bad567bcce4ac41a918eeaf90c

SHA256
e841938e6579b66710a4c6b6ba22b27dc2d64e603e0a8998fb2cecbea1789a27

SHA512
b09e4b1b2480d1a4478ded4316a62e64c9e37cec141304d92d651997e92d54f592e2745f10b2b9fbcde7670783b7c1406f4a1ea3c8df11cf1ce9f6b815b658a0

Download Submit
memory/844-29-0x0000000001C90000-0x0000000001CD2000-memory.dmp

Filesize
264KB

Download
memory/844-31-0x0000000001C90000-0x0000000001CD2000-memory.dmp

Filesize
264KB

Download
memory/844-30-0x0000000001C90000-0x0000000001CD2000-memory.dmp

Filesize
264KB

Download
memory/844-32-0x0000000001C90000-0x0000000001CD2000-memory.dmp

Filesize
264KB

Download
memory/1096-123-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1096-48-0x0000000000370000-0x00000000003BB000-memory.dmp

Filesize
300KB

Download
memory/1096-47-0x00000000002A0000-0x00000000002E2000-memory.dmp

Filesize
264KB

Download
memory/1096-271-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1152-14-0x0000000000410000-0x0000000000452000-memory.dmp

Filesize
264KB

Download
memory/1152-16-0x0000000000410000-0x0000000000452000-memory.dmp

Filesize
264KB

Download
memory/1152-17-0x0000000000410000-0x0000000000452000-memory.dmp

Filesize
264KB

Download
memory/1152-15-0x0000000000410000-0x0000000000452000-memory.dmp

Filesize
264KB

Download
memory/1152-12-0x0000000000410000-0x0000000000452000-memory.dmp

Filesize
264KB

Download
memory/1232-19-0x0000000001F10000-0x0000000001F52000-memory.dmp

Filesize
264KB

Download
memory/1232-22-0x0000000001F10000-0x0000000001F52000-memory.dmp

Filesize
264KB

Download
memory/1232-21-0x0000000001F10000-0x0000000001F52000-memory.dmp

Filesize
264KB

Download
memory/1232-20-0x0000000001F10000-0x0000000001F52000-memory.dmp

Filesize
264KB

Download
memory/1280-25-0x00000000029C0000-0x0000000002A02000-memory.dmp

Filesize
264KB

Download
memory/1280-26-0x00000000029C0000-0x0000000002A02000-memory.dmp

Filesize
264KB

Download
memory/1280-27-0x00000000029C0000-0x0000000002A02000-memory.dmp

Filesize
264KB

Download
memory/1280-24-0x00000000029C0000-0x0000000002A02000-memory.dmp

Filesize
264KB

Download
memory/2528-67-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-63-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-51-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-45-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-43-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-41-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-39-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-38-0x0000000001E70000-0x0000000001EB2000-memory.dmp

Filesize
264KB

Download
memory/2528-37-0x0000000001E70000-0x0000000001EB2000-memory.dmp

Filesize
264KB

Download
memory/2528-36-0x0000000001E70000-0x0000000001EB2000-memory.dmp

Filesize
264KB

Download
memory/2528-35-0x0000000001E70000-0x0000000001EB2000-memory.dmp

Filesize
264KB

Download
memory/2528-34-0x0000000001E70000-0x0000000001EB2000-memory.dmp

Filesize
264KB

Download
memory/2528-53-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-55-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-57-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-59-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-61-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-49-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-65-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x00000000002F0000-0x000000000033B000-memory.dmp

Filesize
300KB

Download
memory/2528-69-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-71-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-73-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-126-0x0000000001E70000-0x0000000001EB2000-memory.dmp

Filesize
264KB

Download
memory/2528-128-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-127-0x0000000077AC0000-0x0000000077AC1000-memory.dmp

Filesize
4KB

Download
memory/2528-75-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2528-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2528-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2528-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2528-150-0x00000000002F0000-0x000000000033B000-memory.dmp

Filesize
300KB

Download
memory/2528-152-0x0000000001E70000-0x0000000001EB2000-memory.dmp

Filesize
264KB

Download
memory/2528-3-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2528-0-0x00000000002A0000-0x00000000002E2000-memory.dmp

Filesize
264KB

Download