Overview

overview

7

Static

static

3

ad7957ed93...18.exe

windows7-x64

7

ad7957ed93...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    130s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20-08-2024 02:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad7957ed9393e8548de6f18b2a665103_JaffaCakes118.exe

  • Size

    38KB

  • MD5

    ad7957ed9393e8548de6f18b2a665103

  • SHA1

    61236345a9758b9f751ac00d7b99ddd7c8d3e34e

  • SHA256

    1212e177454b1ffa0e50e35281f6061133b6707faada829852a408020fbba615

  • SHA512

    f54a8881e04e0c84c4b40ca28441b4bff3610716557fc74ae85365f06989ec97abb01a70a593f53ad1c7bbf9ba72c6ecc92344b6932f7b7a7d367e1ff59265fb

  • SSDEEP

    768:ecNnfawyp9q44b54VaSpalGg/o+pBBr8tyJ7OoW3KcW19:eA7ypI4qOCzJfJU3u9

Score
7/10
adwarediscoveryevasionexecutionpersistencestealertrojan

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad7957ed9393e8548de6f18b2a665103_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ad7957ed9393e8548de6f18b2a665103_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\BXRRMKYSBYCQOG.dll"
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2436
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\GSNX1DDCN.BAT" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s msvidctl.dll
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2924
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:3000
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s itss.dll
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2760
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2996
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2504
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s vbscript.dll
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2948
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s scrrun.dll
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2832
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s jscript.dll
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2656
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2764
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2740
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2908
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:1524
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:848
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\GSNX1DDCN.BAT
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s msvidctl.dll
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2900
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:2780
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s itss.dll
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2732
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2500
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2744
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s vbscript.dll
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2932
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /u /s scrrun.dll
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2840
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s jscript.dll
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2652
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2792
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:1316
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2632
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2040
      • C:\Windows\SysWOW64\reg.exe
        reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\GSNX1DDCN.BAT
    Filesize

    1KB

    MD5

    39738ae0a11bb14a55dc0b4c915dd712

    SHA1

    4dbba6ec5c40a5ba477ed53af9b1a6a43d67c1ed

    SHA256

    8bbeab6abb20ca78e75ca611e0617b2d5364df2742f0bb6011fdd7b56b07a533

    SHA512

    87b2e24aa2446cfae60e1266d37e2696a6d633bd056c64be15b90d38fb1573e88d35dbcb4ebafef5ea58def118fbeb3a8979a0d918a7b95c247b998a842c181a

    Download Submit

  • C:\Windows\BXRRMKYSBYCQOG.dll
    Filesize

    28KB

    MD5

    6bac5f7e22a8ff799e0f1c4f8d7b457f

    SHA1

    a6d290d7eed0aebdca77607e4e1bf170b73c1c21

    SHA256

    e59bcdf77a7167979f63b3a0e26320c30d469d8e26a2197ae8f15f1726c747f6

    SHA512

    368a2f7dc137c6766867c2b04dc6017228a43238748b061bd36c18b25a60d0ad943b4d4b0598fc40bd568b9ab274dd87e49a518a1e9149ccd0284b28b408b40c

    Download Submit

  • C:\Windows\BXRRMKYSBYCQOG.txt
    Filesize

    38KB

    MD5

    feac69776b79259a45af2f2098c778c8

    SHA1

    3f6a7f1673078d306f439b17f983837917f5b707

    SHA256

    1d296e72810ea2d3c74f48f2fc9242416f3a4353201cb61bd5a29dbb2cc52b1c

    SHA512

    671d58071f0c8778a41689b9ad34426c940dad0d282025a1f1e0b2ae4a15b0c5b4c036c19c76099375f06a0e40503a0f9eb34ebe21133b4586c101ae3158366f

    Download Submit

  • \Program Files\0P96AZVT6F\308C0AP.EXE
    Filesize

    38KB

    MD5

    ad7957ed9393e8548de6f18b2a665103

    SHA1

    61236345a9758b9f751ac00d7b99ddd7c8d3e34e

    SHA256

    1212e177454b1ffa0e50e35281f6061133b6707faada829852a408020fbba615

    SHA512

    f54a8881e04e0c84c4b40ca28441b4bff3610716557fc74ae85365f06989ec97abb01a70a593f53ad1c7bbf9ba72c6ecc92344b6932f7b7a7d367e1ff59265fb

    Download Submit