Analysis
-
max time kernel
44s -
max time network
38s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 10:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe
-
Size
933KB
-
MD5
73b5d8e5d68000178099b40fbd87a357
-
SHA1
5be2b7cd0d1c6f30b3a746e26bfe179ccc628b3a
-
SHA256
591a807a568660e7180d9e7b47a47c26422c6f97313a0aec39c7f301c3736a73
-
SHA512
4a084954cbb9b2f494adaf66329e113151a95492b102041639c0f98d7eff21bb19062c129763f685d0857cf4229c8f361c94c9a287ba2f3daef32c1ba42caa0d
-
SSDEEP
24576:THht6pOsAebvfVd8Fwc4MHiLCTDErkfK53JZfmWpwVPNQnM0jd:G6K9drcjbTDtWZZ+aSuM0p
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2744 max2_133daohang4.exe 2664 Baidu-Toolbar-top1.exe -
Loads dropped DLL 64 IoCs
pid Process 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 2744 max2_133daohang4.exe 2744 max2_133daohang4.exe 2744 max2_133daohang4.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 2664 Baidu-Toolbar-top1.exe 2664 Baidu-Toolbar-top1.exe 2664 Baidu-Toolbar-top1.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 2744 max2_133daohang4.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\newicon.ico 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language max2_133daohang4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baidu-Toolbar-top1.exe -
NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x0007000000016d58-6.dat nsis_installer_1 behavioral1/files/0x0007000000016d58-6.dat nsis_installer_2 behavioral1/files/0x0007000000016d60-15.dat nsis_installer_1 -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O)\Command 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\ÊôÐÔ(&D)\Command 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\ÊôÐÔ(&D)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O) 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\ÊôÐÔ(&D) 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\ = "Internet Explorer" 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\DefaultIcon\ = "C:\\Windows\\newicon.ico" 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O)\ = "Open(&O)" 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\Shell\Open(&O)\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE http://www.131u.com/?1" 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\ShellFolder 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\ShellFolder\Attributes = "10" 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A}\DefaultIcon 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09860117-AE68-60e5-9DBE-C2C2388A068A} 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2744 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2744 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2744 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2744 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2744 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2744 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2744 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 30 PID 1848 wrote to memory of 2664 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 31 PID 1848 wrote to memory of 2664 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 31 PID 1848 wrote to memory of 2664 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 31 PID 1848 wrote to memory of 2664 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 31 PID 1848 wrote to memory of 2664 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 31 PID 1848 wrote to memory of 2664 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 31 PID 1848 wrote to memory of 2664 1848 73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\73b5d8e5d68000178099b40fbd87a357_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\max2_133daohang4.exe"C:\Users\Admin\AppData\Local\Temp\max2_133daohang4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\Baidu-Toolbar-top1.exe"C:\Users\Admin\AppData\Local\Temp\Baidu-Toolbar-top1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Filesize1KB
MD55dc5034512d3d0c5863505b122c67e07
SHA1e90389028b2f1b5f6812e7890a6d40cc6aeffc1b
SHA2565284c54137d64c3c7aa5d8a50d7fe05e1583827e8f100007ba66d71a0df9aa9c
SHA5121fba8235b4dfae2118e801426c70c94d8de1ee1ba9c420239d9b9146d7d91a37c0f7c41f295ff7c167410af73cc0d247b2e6ad0de03ffd63d28c83c8f4daa5d5
-
Filesize
842KB
MD5dd8565516a8adefe7cd353759f623331
SHA134ef17f0385f4deae7b5cadd78f1a6039b4ff978
SHA2566fbc37f44470f86b47516dedd1ba86de46dd2716bb42739b0a4e5d540cc111df
SHA51219a61451e8b22c7baece0330297f3b3d35a97182b180a158571e0043784f935d2e9a0d7b3d3a621c1619962f08c2883e9d71b992a491e7ca4abc1ccf53714725
-
Filesize
59KB
MD5698a97c92a639a6e811cf501a7bb06c1
SHA19883a06ca120b000392c6af5aa3f4ba1a627321a
SHA256d1e089d33b48745a61338d671e77c87cf99baa7a9d42d9dc8af7b91e728cfb5f
SHA5126d5bd9da612e23e5a35459b8a6223d354a442897f9a33ab6e17fe21d3b9e3f78e88a952f7e1d5e20a5a1d6181f8fcd63848af0c3200c45d2bd7230b13a7f7a5c
-
Filesize
18KB
MD55e08ae18abcc8fc1cd639fed7e276eaf
SHA110570a62a2c5c41ef2939e101617416f9a8acfe3
SHA256c7e1cfd7b1f3b446dd12dc35d36ed2c7e1e30b471ea47e8d8cd6b40f6ff84a2b
SHA512f8bb2dd54d1ea9bd2bed565903af2eb06995baec5c1480c6b73af9f51639ed259e510b87d8248f4551b004e4d2aa030af5f161b486233d6e45bbc152fe8bfa71
-
Filesize
4KB
MD5073d44e11a4bcff06e72e1ebfe5605f7
SHA15f4e85ab7a1a636d95b50479a10bcb5583af93f3
SHA256b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb
SHA512e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667