5a002015f4d1ef823aaea9fd703ef1b139249f5c8e9805cc5c67dc6c535eca3e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe
Size

357KB
MD5

673ed9a584f0346d312b805c3dbef430
SHA1

2ade715a014c32fd1ce20947e873d779d501c83f
SHA256

5a002015f4d1ef823aaea9fd703ef1b139249f5c8e9805cc5c67dc6c535eca3e
SHA512

e2c6db620bf859db1dbc0c32d47d5ccf9774e012ce645a62fa2dbfb210adf3bc25faef64606cf39c90c15f158888c01d037176da98f4f9329cae235a1bc18a97
SSDEEP

6144:C4//2pBmAHs3czyOxW8RjSqjAvzxCaQHkRxX0ZjOEd4xEtpzbpw:C4GpBfHs3czfxW8B7jAv1CaXrIGGbS

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2576	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2252	irbii.exe

Loads dropped DLL 2 IoCs

pid	Process
2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe
2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\{F4363D88-6FEF-AD4F-FCEF-4765F9626478} = "C:\\Users\\Admin\\AppData\\Roaming\\Qocube\\irbii.exe"	irbii.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Privacy	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe
2252	irbii.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe
2252	irbii.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2252	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2252	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2252	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2252	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	30
PID 2252 wrote to memory of 1108	2252	irbii.exe	19
PID 2252 wrote to memory of 1108	2252	irbii.exe	19
PID 2252 wrote to memory of 1108	2252	irbii.exe	19
PID 2252 wrote to memory of 1108	2252	irbii.exe	19
PID 2252 wrote to memory of 1108	2252	irbii.exe	19
PID 2252 wrote to memory of 1156	2252	irbii.exe	20
PID 2252 wrote to memory of 1156	2252	irbii.exe	20
PID 2252 wrote to memory of 1156	2252	irbii.exe	20
PID 2252 wrote to memory of 1156	2252	irbii.exe	20
PID 2252 wrote to memory of 1156	2252	irbii.exe	20
PID 2252 wrote to memory of 1192	2252	irbii.exe	21
PID 2252 wrote to memory of 1192	2252	irbii.exe	21
PID 2252 wrote to memory of 1192	2252	irbii.exe	21
PID 2252 wrote to memory of 1192	2252	irbii.exe	21
PID 2252 wrote to memory of 1192	2252	irbii.exe	21
PID 2252 wrote to memory of 1568	2252	irbii.exe	25
PID 2252 wrote to memory of 1568	2252	irbii.exe	25
PID 2252 wrote to memory of 1568	2252	irbii.exe	25
PID 2252 wrote to memory of 1568	2252	irbii.exe	25
PID 2252 wrote to memory of 1568	2252	irbii.exe	25
PID 2252 wrote to memory of 2552	2252	irbii.exe	29
PID 2252 wrote to memory of 2552	2252	irbii.exe	29
PID 2252 wrote to memory of 2552	2252	irbii.exe	29
PID 2252 wrote to memory of 2552	2252	irbii.exe	29
PID 2252 wrote to memory of 2552	2252	irbii.exe	29
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2576	2552	673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe	31
PID 2252 wrote to memory of 3060	2252	irbii.exe	34
PID 2252 wrote to memory of 3060	2252	irbii.exe	34
PID 2252 wrote to memory of 3060	2252	irbii.exe	34
PID 2252 wrote to memory of 3060	2252	irbii.exe	34
PID 2252 wrote to memory of 3060	2252	irbii.exe	34

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1108

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1156

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\673ed9a584f0346d312b805c3dbef430_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Roaming\Qocube\irbii.exe
    "C:\Users\Admin\AppData\Roaming\Qocube\irbii.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp69e6c13b.bat"
    3⤵
    - Deletes itself
    PID:2576

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp69e6c13b.bat

Filesize
271B

MD5
870463bdfc8f61b4f5edb7754363c9fa

SHA1
c6fcc17ef5e8303fc1f4cf6e009fdeb0aab55976

SHA256
b25cbae0590c58750ad87c1c874e0ca9b2acd654f1ef20ae1f161202a4d2bdbe

SHA512
7370eff1221bbb91cd89f1e7d77062d4414ac4a00c6eb1d1c6ea2e155100af0e98f66f1cf254c6a5b3c45524247eeac2c98cbad6d16ed41237fb8b743c94040b

Download Submit
\Users\Admin\AppData\Roaming\Qocube\irbii.exe

Filesize
357KB

MD5
99302d86e1a10a97407124c0236e53a8

SHA1
53f9a5e6196b8e54af5d170ea4f92ee860fc53a8

SHA256
0384569c77b247116fa00bbc6584a1678f20b8a41c53a2e1f43bc8ec3f9e81bc

SHA512
2e55404539313e081ef732d5c6ecf757aedb5166a0ed1a4cb38d4b827ccb00d403e38301169dd764adb09aef97f52359690835fbb64e850da8cb314f5b5cae1f

Download Submit
memory/1108-22-0x0000000000210000-0x0000000000254000-memory.dmp

Filesize
272KB

Download
memory/1108-19-0x0000000000210000-0x0000000000254000-memory.dmp

Filesize
272KB

Download
memory/1108-23-0x0000000000210000-0x0000000000254000-memory.dmp

Filesize
272KB

Download
memory/1108-25-0x0000000000210000-0x0000000000254000-memory.dmp

Filesize
272KB

Download
memory/1108-21-0x0000000000210000-0x0000000000254000-memory.dmp

Filesize
272KB

Download
memory/1156-29-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download
memory/1156-32-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download
memory/1156-30-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download
memory/1156-31-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download
memory/1192-37-0x0000000002560000-0x00000000025A4000-memory.dmp

Filesize
272KB

Download
memory/1192-34-0x0000000002560000-0x00000000025A4000-memory.dmp

Filesize
272KB

Download
memory/1192-35-0x0000000002560000-0x00000000025A4000-memory.dmp

Filesize
272KB

Download
memory/1192-36-0x0000000002560000-0x00000000025A4000-memory.dmp

Filesize
272KB

Download
memory/1568-39-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1568-41-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1568-40-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/1568-42-0x0000000001D40000-0x0000000001D84000-memory.dmp

Filesize
272KB

Download
memory/2252-283-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2252-285-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2252-15-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2252-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2252-16-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2252-286-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-48-0x0000000001F40000-0x0000000001F84000-memory.dmp

Filesize
272KB

Download
memory/2552-44-0x0000000001F40000-0x0000000001F84000-memory.dmp

Filesize
272KB

Download
memory/2552-0-0x0000000000270000-0x00000000002B4000-memory.dmp

Filesize
272KB

Download
memory/2552-52-0x0000000001F40000-0x0000000001F84000-memory.dmp

Filesize
272KB

Download
memory/2552-59-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-57-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-55-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-65-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-69-0x0000000077550000-0x0000000077551000-memory.dmp

Filesize
4KB

Download
memory/2552-67-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-63-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-72-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-70-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-61-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-53-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-46-0x0000000001F40000-0x0000000001F84000-memory.dmp

Filesize
272KB

Download
memory/2552-50-0x0000000001F40000-0x0000000001F84000-memory.dmp

Filesize
272KB

Download
memory/2552-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-78-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-76-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-74-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-80-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-137-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2552-160-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download
memory/2552-161-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-1-0x00000000002C0000-0x0000000000320000-memory.dmp

Filesize
384KB

Download