Overview
overview
7Static
static
3aeac60242a...18.exe
windows7-x64
7aeac60242a...18.exe
windows10-2004-x64
7$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$0/wyeke.dll
windows7-x64
3$0/wyeke.dll
windows10-2004-x64
3$0/wyeke.exe
windows7-x64
1$0/wyeke.exe
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 09:20
Static task
static1
Behavioral task
behavioral1
Sample
aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$0/uninstall.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
$0/uninstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$0/wyeke.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
$0/wyeke.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$0/wyeke.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
$0/wyeke.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe
-
Size
646KB
-
MD5
aeac60242aa50b684ee442a3a6ab6ba6
-
SHA1
d51ab9f1434734352e0baa232f3620f6680ce24c
-
SHA256
22a7a589ea5387396db7354ac92a32119e03c00846e84455ec70fd1a286a6962
-
SHA512
8b91fdaf4a2d7d77fb1e10d99905805795163327b2054252263b416f79bd5705ef614a77ce4c3287d0c81f99378a1a217c50c0029f8ee0948d05bfb64979c1c7
-
SSDEEP
12288:WuDa9X5y8J//i+w02KSpovfpVMHIJBNNTvqYfewyotQgWP:WWc59XiMvLrTbGwyE+P
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2452 wyeke.exe 2688 wyeke.exe 2604 wyeke135.exe 2500 wyeke.exe -
Loads dropped DLL 9 IoCs
pid Process 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 2688 wyeke.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2500 wyeke.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat wyeke135.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EJFTT3FW.htm wyeke135.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Wyeke\wyeke.dll wyeke.exe File opened for modification C:\Program Files (x86)\Wyeke\wyeke.dll wyeke.exe File created C:\Program Files (x86)\Wyeke\wyeke.exe wyeke.exe File created C:\Program Files (x86)\Wyeke\uninstall.exe aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wyeke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wyeke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wyeke135.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x0007000000014b6f-44.dat nsis_installer_1 -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B4E293D4-B27D-4504-9DF4-FF31E6054029}\ba-14-3b-36-6f-a0 wyeke135.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-14-3b-36-6f-a0\WpadDecisionReason = "1" wyeke135.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-14-3b-36-6f-a0\WpadDecisionTime = e093247ee2f2da01 wyeke135.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" wyeke135.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" wyeke135.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wyeke135.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B4E293D4-B27D-4504-9DF4-FF31E6054029}\WpadDecision = "0" wyeke135.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B4E293D4-B27D-4504-9DF4-FF31E6054029}\WpadNetworkName = "Network 3" wyeke135.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" wyeke135.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" wyeke135.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" wyeke135.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wyeke135.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wyeke135.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B4E293D4-B27D-4504-9DF4-FF31E6054029}\WpadDecisionReason = "1" wyeke135.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-14-3b-36-6f-a0\WpadDecision = "0" wyeke135.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B4E293D4-B27D-4504-9DF4-FF31E6054029}\WpadDecisionTime = e093247ee2f2da01 wyeke135.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-14-3b-36-6f-a0 wyeke135.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix wyeke135.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B4E293D4-B27D-4504-9DF4-FF31E6054029} wyeke135.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wyeke135.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings wyeke135.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections wyeke135.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings wyeke135.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad wyeke135.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe 2604 wyeke135.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2500 wyeke.exe 2500 wyeke.exe 2500 wyeke.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2452 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2452 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2452 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2452 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2688 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 29 PID 2676 wrote to memory of 2688 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 29 PID 2676 wrote to memory of 2688 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 29 PID 2676 wrote to memory of 2688 2676 aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe 29 PID 2604 wrote to memory of 2500 2604 wyeke135.exe 31 PID 2604 wrote to memory of 2500 2604 wyeke135.exe 31 PID 2604 wrote to memory of 2500 2604 wyeke135.exe 31 PID 2604 wrote to memory of 2500 2604 wyeke135.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aeac60242aa50b684ee442a3a6ab6ba6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\wyeke.exe"C:\Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\wyeke.exe" "C:\Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\wyeke.dll" -r2⤵
- Executes dropped EXE
PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\wyeke.exe"C:\Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\wyeke.exe" "C:\Users\Admin\AppData\Local\Temp\nsy4F0C.tmp\wyeke.dll" Install ""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2688
-
-
C:\ProgramData\Wyeke\wyeke135.exe"C:\ProgramData\Wyeke\wyeke135.exe" "C:\Program Files (x86)\Wyeke\wyeke.dll" Service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Wyeke\wyeke.exe"C:\Program Files (x86)\Wyeke\wyeke.exe" "C:\Program Files (x86)\Wyeke\wyeke.dll" Main2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5d445cf2b1abb1e43b5bc15ad8b3ee425
SHA1c32bd43025189c83ffc2d4656c7558b30f623c5a
SHA2567ce4961b1e2246109df696d8479c3b6d41f658010bd4455d3573c5933e189a53
SHA512099f2a0783d9415a3e27d2fdf5af83461327ec80f8d801396be91e4c8546377fd884aad75ce1d80ae490daa3db74f6bd2176b46129b8015583321e4e3bcdb32d
-
Filesize
576KB
MD5cc49f5ca2c041dfe9ccf907909409545
SHA1ea775647b76898bf044f8efbefcb5d74367afc2a
SHA256b9f2beaf23e72be09ab3b4f1d4d55bae4142812cea9ebdca5bbed3b031b3f0a0
SHA51247da82e4f3c77702a09c8dd716bd7034a6efbdf63ab79579157e5bd9d9fe4b289cb2897156140f37327a813ae81b95506fa4c2046aeabf9e33cbeaed7443d8f6
-
Filesize
45KB
MD51ad77afb3a6e69b9369d46b66b2d4dd7
SHA1f45d8e761183fae1a7a479b8c9618b40a06a6008
SHA2566826c03be926075bf3ea7503caf5e152d33b224fd82fa87bfd582701a659dbd6
SHA512aded9b92971c26f078ac583667136a811499cac67f44601eda227e98dd096a1cf2245aee98e931b75e5eacaac494f1dbb1217a3e19019d7afc0ba5fd45934926