Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 05:59
Behavioral task
behavioral1
Sample
a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe
-
Size
14KB
-
MD5
a1700b9d10ec5952d089533d2f7e85ef
-
SHA1
6a6b977c88aaf3848fe4f1edde8d10f6502b89b8
-
SHA256
9b2b66bf043e1fb095e631f20e1bfcffbc11b118f6a2d051f1fc48069f53cbfd
-
SHA512
e4a8ca4f474d2320e3674f28d253515e9d7fb3b3d5f882b9c97dcbd01ba77c4d9e4bcadc7f3c526d453da03988f614b5861c334bbad5d7ab3bc9fbca8933cd61
-
SSDEEP
192:sz2gN+ejOArsYAcW1CEGM8O7iWfo6QHyWmMjo3PrsfW3YoTL3BgHJjSbC/88zb0:sfJAAmGM8OixmMjiKIDOMbC5zI
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00080000000234b9-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2596 sbsm.exe -
Loads dropped DLL 1 IoCs
pid Process 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1424-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00080000000234b9-2.dat upx behavioral2/memory/1424-5-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral2/memory/1424-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1424-12-0x0000000010000000-0x0000000010009000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88} a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}\ a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchagate.com/index.php?b=1&t=0&q={searchTerms}" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\SearchScopes a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.gateietool.com/redirect.php" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Search a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 2596 sbsm.exe 2596 sbsm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2596 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 84 PID 1424 wrote to memory of 2596 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 84 PID 1424 wrote to memory of 2596 1424 a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1700b9d10ec5952d089533d2f7e85ef_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD531175b6397f5070773fd1bcc9b4973d2
SHA1faaaa3e09730c9b0a5b4df9f27972415da6843f3
SHA256cb6e408c74f854f99cb0d5cb6cfa07841ab12e000a87edb5a8589d11721a6135
SHA51285b476e2115db07341c65412a0858a4c73c850c4d8f6053611ae72c35204026987ba884a35eb48fe35d7d7d8fb6a3abe69ad35480541a39907970da05422360a
-
Filesize
4KB
MD59e439bcf582a433c413346b4d45c6622
SHA1926e6d23ecfcfe189a790283928043de2a856167
SHA256190ee7a0f43b23b42a6e83bf9a45b488fcd898542aa79ea03dc366ab443fa301
SHA512dcb96f7bd80a0aa33b5ae9916629d3ef64e4e16998ff3b77dd865c55587033b65743f31aee23f026a66189b2e15bdab7774b98f2e04d2ee3de8958fb335a747c