Overview
overview
7Static
static
3960d5c7972...18.exe
windows7-x64
7960d5c7972...18.exe
windows10-2004-x64
7$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$0/zwankysearch.dll
windows7-x64
1$0/zwankysearch.dll
windows10-2004-x64
1$0/zwankysearch.exe
windows7-x64
1$0/zwankysearch.exe
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 12:12
Static task
static1
Behavioral task
behavioral1
Sample
960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$0/uninstall.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
$0/uninstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$0/zwankysearch.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
$0/zwankysearch.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$0/zwankysearch.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
$0/zwankysearch.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe
-
Size
655KB
-
MD5
960d5c797298fbbe45eb9dd2fafade0d
-
SHA1
1a34911fea08ca38a24a7b28a5c0531ef23659a8
-
SHA256
e1f705a150f56a760af68e717f90cd553bf7eaba7861e7fe6596ba76d06b3f7f
-
SHA512
6ae4da5d2eb692a9f1e5845458c160f9566322d5e3b21afd3765c60b6bcfbb3496b490b732db4501c881188b3f4ec06fdeb5ccf02a01cea4705b73e474c0a6dc
-
SSDEEP
12288:8ZV4oaq2hwFKUanKHE2O4F/i0Mt/YLJa19G5HREoc5hJqM9W8nGa54dqDqu5clH:8r32hwFKHnj4qOLJa198IhJqms4DquaN
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2500 zwankysearch.exe 2372 zwankysearch.exe 2912 zwankysearch153.exe 2900 zwankysearch.exe -
Loads dropped DLL 9 IoCs
pid Process 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 2372 zwankysearch.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2900 zwankysearch.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat zwankysearch153.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X3GZRKM5.htm zwankysearch153.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\ZwankySearch\zwankysearch.dll zwankysearch.exe File opened for modification C:\Program Files (x86)\ZwankySearch\zwankysearch.dll zwankysearch.exe File created C:\Program Files (x86)\ZwankySearch\zwankysearch.exe zwankysearch.exe File created C:\Program Files (x86)\ZwankySearch\uninstall.exe 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zwankysearch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zwankysearch153.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zwankysearch.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x0007000000016dd3-48.dat nsis_installer_1 -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-d2-c8-3b-0b-53\WpadDecisionReason = "1" zwankysearch153.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-d2-c8-3b-0b-53\WpadDecision = "0" zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections zwankysearch153.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C93C552-188C-4A16-B876-D005F62698EC} zwankysearch153.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C93C552-188C-4A16-B876-D005F62698EC}\WpadDecisionReason = "1" zwankysearch153.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix zwankysearch153.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad zwankysearch153.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-d2-c8-3b-0b-53\WpadDecisionTime = f0cacc8c43eeda01 zwankysearch153.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" zwankysearch153.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" zwankysearch153.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings zwankysearch153.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 zwankysearch153.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 zwankysearch153.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C93C552-188C-4A16-B876-D005F62698EC}\WpadDecision = "0" zwankysearch153.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C93C552-188C-4A16-B876-D005F62698EC}\WpadNetworkName = "Network 3" zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C93C552-188C-4A16-B876-D005F62698EC}\e6-d2-c8-3b-0b-53 zwankysearch153.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" zwankysearch153.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3C93C552-188C-4A16-B876-D005F62698EC}\WpadDecisionTime = f0cacc8c43eeda01 zwankysearch153.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-d2-c8-3b-0b-53 zwankysearch153.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe 2912 zwankysearch153.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2900 zwankysearch.exe 2900 zwankysearch.exe 2900 zwankysearch.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2500 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 30 PID 1956 wrote to memory of 2500 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 30 PID 1956 wrote to memory of 2500 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 30 PID 1956 wrote to memory of 2500 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 30 PID 1956 wrote to memory of 2372 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 31 PID 1956 wrote to memory of 2372 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 31 PID 1956 wrote to memory of 2372 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 31 PID 1956 wrote to memory of 2372 1956 960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe 31 PID 2912 wrote to memory of 2900 2912 zwankysearch153.exe 33 PID 2912 wrote to memory of 2900 2912 zwankysearch153.exe 33 PID 2912 wrote to memory of 2900 2912 zwankysearch153.exe 33 PID 2912 wrote to memory of 2900 2912 zwankysearch153.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\960d5c797298fbbe45eb9dd2fafade0d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\nsj9253.tmp\zwankysearch.exe"C:\Users\Admin\AppData\Local\Temp\nsj9253.tmp\zwankysearch.exe" "C:\Users\Admin\AppData\Local\Temp\nsj9253.tmp\zwankysearch.dll" cy2rh34962992662⤵
- Executes dropped EXE
PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\nsj9253.tmp\zwankysearch.exe"C:\Users\Admin\AppData\Local\Temp\nsj9253.tmp\zwankysearch.exe" "C:\Users\Admin\AppData\Local\Temp\nsj9253.tmp\zwankysearch.dll" xusicebud "" rerecorivis2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2372
-
-
C:\ProgramData\ZwankySearch\zwankysearch153.exe"C:\ProgramData\ZwankySearch\zwankysearch153.exe" "C:\Program Files (x86)\ZwankySearch\zwankysearch.dll" rerecorivis tosezufi1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\ZwankySearch\zwankysearch.exe"C:\Program Files (x86)\ZwankySearch\zwankysearch.exe" "C:\Program Files (x86)\ZwankySearch\zwankysearch.dll" yicoriva ededetiziro2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD571c085dade61786f05adc685d4f74b01
SHA18b58d09e5c47a14edf983277bfff8ea6db313d4c
SHA256cd2ed594c06c16d66b534e6aaf76afb99c0dcbf77f4906ceba9c29495d300af2
SHA512add86e11840a0a69b3e4ba51756e672f58b9f363436c2fd7fb8b549b7f1fae0198093980b8bf93a984a920eb37703cf9af3280e11e0907ae202a8bd441a7999e
-
Filesize
564KB
MD5372ce99ab45d93db61f233d32a168f6e
SHA1764eefe6632198d6b4053b8dd54d3c12042787ef
SHA2568672f7244fba688e01d511e48d8e85517cf0f440010dee31a51786d4a2e92509
SHA512ab2e0a59260aef32140c72f3ab7da52779f6cc63772e2c4afc4e6d6dd65b6613c9d43bd55c5bbeec8d4de46f04e52e9d3b158af2552a56f9224c361968930803
-
Filesize
48KB
MD5ed758535ce8531f2d471d87e1798532b
SHA158c191bd4c41b19abb54a8b313381d657fd1a148
SHA2562b3bc89f6c62446657fe762a1dfdf1feb40c73625f21d5829e5fef3808d78723
SHA51295cd159bf798520a6d9bf67eb8f8ae142ee730b9706627962bb9a74cb0803c24d4decf6664bea4d81ba3c7cdd0589c38593bee7a87a4f25e3c9219a9e2c1b331