0fd0899e365646ef59c5971addf8666f066015bfe400d7977291ebb145f9937e

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe
Size

364KB
MD5

88b328a1ccd518514da2fe88c61bfee2
SHA1

594b94463da34d5b23068a0c37197989728a243a
SHA256

0fd0899e365646ef59c5971addf8666f066015bfe400d7977291ebb145f9937e
SHA512

cc16ea812fa3deac3418e1c48a6eef398f609958178ccc85152a91f90d48796f9aef0c7c32a6350fab96fee742f97d47dc29347296fd126d921ed8bb16ba1d08
SSDEEP

6144:Xn8ukcbLviSGqJjW8lE0crUTMX+82IXpW0vH66RVas3Gmxq2/2eW/ZDUp/fIIbGi:Xn8HcbL6Sdvu0YUTk1ZW0vH66vW92/Cu

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2856	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

moarg.exe

pid	Process
2772	moarg.exe

Loads dropped DLL 2 IoCs

Processes:

88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe

pid	Process
2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe
2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x00080000000186f3-12.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

moarg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\{C4A05C48-6809-AD4F-9B76-1BFCA18838E1} = "C:\\Users\\Admin\\AppData\\Roaming\\Ipgay\\moarg.exe"	moarg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2660 set thread context of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Privacy	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

moarg.exe

pid	Process
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe
2772	moarg.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe

description	pid	Process
Token: SeSecurityPrivilege	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe
Token: SeSecurityPrivilege	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe
Token: SeSecurityPrivilege	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exemoarg.exe

description	pid	Process	procid_target
PID 2660 wrote to memory of 2772	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	30
PID 2660 wrote to memory of 2772	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	30
PID 2660 wrote to memory of 2772	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	30
PID 2660 wrote to memory of 2772	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	30
PID 2772 wrote to memory of 1100	2772	moarg.exe	19
PID 2772 wrote to memory of 1100	2772	moarg.exe	19
PID 2772 wrote to memory of 1100	2772	moarg.exe	19
PID 2772 wrote to memory of 1100	2772	moarg.exe	19
PID 2772 wrote to memory of 1100	2772	moarg.exe	19
PID 2772 wrote to memory of 1172	2772	moarg.exe	20
PID 2772 wrote to memory of 1172	2772	moarg.exe	20
PID 2772 wrote to memory of 1172	2772	moarg.exe	20
PID 2772 wrote to memory of 1172	2772	moarg.exe	20
PID 2772 wrote to memory of 1172	2772	moarg.exe	20
PID 2772 wrote to memory of 1228	2772	moarg.exe	21
PID 2772 wrote to memory of 1228	2772	moarg.exe	21
PID 2772 wrote to memory of 1228	2772	moarg.exe	21
PID 2772 wrote to memory of 1228	2772	moarg.exe	21
PID 2772 wrote to memory of 1228	2772	moarg.exe	21
PID 2772 wrote to memory of 2028	2772	moarg.exe	23
PID 2772 wrote to memory of 2028	2772	moarg.exe	23
PID 2772 wrote to memory of 2028	2772	moarg.exe	23
PID 2772 wrote to memory of 2028	2772	moarg.exe	23
PID 2772 wrote to memory of 2028	2772	moarg.exe	23
PID 2772 wrote to memory of 2660	2772	moarg.exe	29
PID 2772 wrote to memory of 2660	2772	moarg.exe	29
PID 2772 wrote to memory of 2660	2772	moarg.exe	29
PID 2772 wrote to memory of 2660	2772	moarg.exe	29
PID 2772 wrote to memory of 2660	2772	moarg.exe	29
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31
PID 2660 wrote to memory of 2856	2660	88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe	31

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1100

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228
- C:\Users\Admin\AppData\Local\Temp\88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\88b328a1ccd518514da2fe88c61bfee2_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Roaming\Ipgay\moarg.exe
    "C:\Users\Admin\AppData\Roaming\Ipgay\moarg.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp34614c6b.bat"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2856

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp34614c6b.bat

Filesize
271B

MD5
660218214ac46528e4de7de47b04d2e6

SHA1
65198d2f911585d8d5b1397be495a31ad93160b7

SHA256
eafcc194d5c56e6df9c83e24b73482a13e85222ed8ccae308674626a32e2744d

SHA512
9ad124716a52dc997b42e62f058d237045a109c9ea6797ab07366f49e815753e243682201df6be9c11f48a7edf75dd94d72f8c3a53ec6b11627928db08755cd6

Download Submit
C:\Users\Admin\AppData\Roaming\Ipgay\moarg.exe

Filesize
364KB

MD5
dd8e02ed99059645ed3a37508505ae8e

SHA1
6c56f57d7eb100cd6f9327a49818b2d96f24eed7

SHA256
0d862533bb07306db12393d98d6c142c15ecdfd01ce1be79e1cff56f5aa9ab08

SHA512
1269d65845a65b182bf212fe9350408b1463ebdae69b1c3c449f6a04bb764472b5b12c328ce989ba4ee26bc87b3a48f51e4d2ffd66f922c671f817f14c85e2d5

Download Submit
C:\Users\Admin\AppData\Roaming\Suydxi\qaoft.bai

Filesize
380B

MD5
37abb45297a5a7767d96bd5bf887f0ff

SHA1
8fde7399d9850983e323525936d9a983a8992289

SHA256
1966d22873baf5a36d4f89620811e34bfed1135373e6ec59b8cf0ea1effc16b2

SHA512
24c0fe3e89f5364ec4fb5b0dadcd2f07cebc15486b7e7e15b83fd6d4896cdc0bc6472543ed6445029d8073fc028fea91e41be4d5c2139925b58feaa991ff0e0e

Download Submit
memory/1100-21-0x0000000002010000-0x000000000204F000-memory.dmp

Filesize
252KB

Download
memory/1100-19-0x0000000002010000-0x000000000204F000-memory.dmp

Filesize
252KB

Download
memory/1100-17-0x0000000002010000-0x000000000204F000-memory.dmp

Filesize
252KB

Download
memory/1100-23-0x0000000002010000-0x000000000204F000-memory.dmp

Filesize
252KB

Download
memory/1100-15-0x0000000002010000-0x000000000204F000-memory.dmp

Filesize
252KB

Download
memory/1172-26-0x00000000002D0000-0x000000000030F000-memory.dmp

Filesize
252KB

Download
memory/1172-27-0x00000000002D0000-0x000000000030F000-memory.dmp

Filesize
252KB

Download
memory/1172-28-0x00000000002D0000-0x000000000030F000-memory.dmp

Filesize
252KB

Download
memory/1172-29-0x00000000002D0000-0x000000000030F000-memory.dmp

Filesize
252KB

Download
memory/1228-33-0x0000000002E40000-0x0000000002E7F000-memory.dmp

Filesize
252KB

Download
memory/1228-34-0x0000000002E40000-0x0000000002E7F000-memory.dmp

Filesize
252KB

Download
memory/1228-32-0x0000000002E40000-0x0000000002E7F000-memory.dmp

Filesize
252KB

Download
memory/1228-31-0x0000000002E40000-0x0000000002E7F000-memory.dmp

Filesize
252KB

Download
memory/2028-39-0x0000000001EE0000-0x0000000001F1F000-memory.dmp

Filesize
252KB

Download
memory/2028-37-0x0000000001EE0000-0x0000000001F1F000-memory.dmp

Filesize
252KB

Download
memory/2028-41-0x0000000001EE0000-0x0000000001F1F000-memory.dmp

Filesize
252KB

Download
memory/2028-43-0x0000000001EE0000-0x0000000001F1F000-memory.dmp

Filesize
252KB

Download
memory/2660-153-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2660-58-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-64-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-154-0x00000000003A0000-0x00000000003DF000-memory.dmp

Filesize
252KB

Download
memory/2660-2-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2660-152-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2660-46-0x00000000003A0000-0x00000000003DF000-memory.dmp

Filesize
252KB

Download
memory/2660-78-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-76-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-74-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-72-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-68-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-66-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-62-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-60-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-70-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-56-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-54-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-52-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2660-47-0x00000000003A0000-0x00000000003DF000-memory.dmp

Filesize
252KB

Download
memory/2660-49-0x00000000003A0000-0x00000000003DF000-memory.dmp

Filesize
252KB

Download
memory/2660-14-0x0000000002450000-0x0000000002586000-memory.dmp

Filesize
1.2MB

Download
memory/2660-50-0x00000000003A0000-0x00000000003DF000-memory.dmp

Filesize
252KB

Download
memory/2660-48-0x00000000003A0000-0x00000000003DF000-memory.dmp

Filesize
252KB

Download
memory/2660-3-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2660-0-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2660-1-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2772-51-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2772-274-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download