Overview
overview
7Static
static
33cc9ddc779...18.exe
windows7-x64
73cc9ddc779...18.exe
windows10-2004-x64
7"aminstall.dll
windows7-x64
1"aminstall.dll
windows10-2004-x64
3"ice_breaker.exe
windows7-x64
3"ice_breaker.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3image_tool.dll
windows7-x64
1image_tool.dll
windows10-2004-x64
1prog.dll
windows7-x64
1prog.dll
windows10-2004-x64
1readme.html
windows7-x64
1readme.html
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
3cc9ddc779bbcf43db528e862af1c25d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3cc9ddc779bbcf43db528e862af1c25d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
"aminstall.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
"aminstall.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
"ice_breaker.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
"ice_breaker.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
image_tool.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
image_tool.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
prog.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
prog.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
readme.html
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
readme.html
Resource
win10v2004-20240709-en
General
-
Target
"ice_breaker.exe
-
Size
1.3MB
-
MD5
46eff05e2e83ae0793b4d4e7668b7e58
-
SHA1
cda0ea5caacea4b85bd5ed75faaad088420900a0
-
SHA256
abd26a2aa15de7306bd521c01bd9e200e4f69f3e84b45c382887e54417282ab5
-
SHA512
afe68034d4c73712609f56425134bd3523eead5d5334783ed6d1eb7a4461282592991c818fa0fc7d6a3148ed56a2ef2098122e77d12ed095728efddf944351b6
-
SSDEEP
24576:eL/6W6OzdvCnjyYIAH7JMwLU02Qa+iL65SCwWVGZGv:8jtRYj7R76+FavLLWlv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main _ice_breaker.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch _ice_breaker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" _ice_breaker.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe 2084 _ice_breaker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2084 _ice_breaker.exe 2084 _ice_breaker.exe