Overview

overview

7

Static

static

1

b6808541a6...18.exe

windows7-x64

7

b6808541a6...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 05:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b6808541a60db5b65164df9da5bc91c3_JaffaCakes118.exe

  • Size

    809KB

  • MD5

    b6808541a60db5b65164df9da5bc91c3

  • SHA1

    c6011c36d4bc0cd3e159c01af356975c8fb4418e

  • SHA256

    da4bba5e2279a86fbebc21b6bdb851e98cf0b7de3ca55aa0fd46175670231a0f

  • SHA512

    fbe53b1f28b124b4aa33df8f892c9d6d062fb4691f4312b0b9df9000358d38a76310f176100b94eaf711033b9f3233ba07113052e70af50bfc8e3d4e800434b0

  • SSDEEP

    24576:ztPdaPXHpBr7M8/6u5U3Pl1lVWp7NRsMKqj69j:RPdaPXHpBf0IsPl1lVgD5m

Score
7/10
adwarediscoverystealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6808541a60db5b65164df9da5bc91c3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b6808541a60db5b65164df9da5bc91c3_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3256
    • C:\Users\Admin\AppData\Local\Temp\b6808541a60db5b65164df9da5bc91c3_JaffaCakes118-0CB8.exe
      "C:\Users\Admin\AppData\Local\Temp\b6808541a60db5b65164df9da5bc91c3_JaffaCakes118-0CB8.exe" /q2 "C:\Users\Admin\AppData\Local\Temp\b6808541a60db5b65164df9da5bc91c3_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Users\Admin\AppData\Local\Temp\B592E9DA\x86\regsvr32.exe
        "C:\Users\Admin\AppData\Local\Temp\B592E9DA\x86\regsvr32.exe" "C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll" /i:`` /r
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll
    Filesize

    190KB

    MD5

    bb9243af2da6b2cbbc73da1be2b1bea2

    SHA1

    9f9d8710b9591a10fbfcdcd603dd7a2eada75f51

    SHA256

    963ebd01b9d4e368b392bfa9d78682a5ae241ed0bb6ce34cd5134ad1c6e9fb63

    SHA512

    ebdb5bfc7b63db21cb190dde8d25578eed0154a84760c7a64dbbcdb6730987cdd29f825d395bf33e2f83a1c5b3a47529b46cde1a42a5c425552298f6e8b5b219

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\B592E9DA\Setup.ico
    Filesize

    4KB

    MD5

    60e3ef9326e8c3f574a2c7b5a31fd895

    SHA1

    d3aa40f8de5c549e6abb189421d6cdcd75ac64f6

    SHA256

    5e8c38cabd089ecd573d953cf2ade243459d7c06aab7b9698975e10dd7f34689

    SHA512

    9a9be32fb1b4355f37766c5296139012d2fd931fb0db871307059cd0afc063a334165f34069a27ed8850889175e2f5f00be65ac2e8b9d22903754a043ae04906

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\B592E9DA\_Setup.dll
    Filesize

    828KB

    MD5

    d054f3ee470d23944873b60a7d324cf4

    SHA1

    e9f8ab51e5d85d497024296b6c7b938aca99b020

    SHA256

    ae4c78a065c5ed25205315008c3038326377de13a60e2ba3b4cd65d4013b756c

    SHA512

    07569b8811b7f351f8152ef0c1aabc5a8565f98eeba21cd9ca1a27cbb2b0ee52d03493d759baad620d23b27c7f3151b91ce7ceda18f7499f686e7eb43aa3e4a2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\B592E9DA\_Setupx.dll
    Filesize

    350KB

    MD5

    e927f64a8ed563b6a492770f2e7568eb

    SHA1

    fa93cbc3743e72d1330fb72049031808bbd0250b

    SHA256

    9a94a0c99d3e03159a0633479cd23b254ef67a7ae72f225dbef14ead43d1d89f

    SHA512

    e5f9a9116940de88cedab03c1075d69ae7aa21e3b702f6ec6e18782ced1d538d35ab7d741aaad0c80ec1c0eea0040a6aabcc97ffd7e716555f2efbd1b7f6afef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\B592E9DA\x86\regsvr32.exe
    Filesize

    6KB

    MD5

    761f21e3a3cf5a0cc5b6d4755e604883

    SHA1

    36472157f38ef7b33f2103829fc6e2f440266777

    SHA256

    e1aa5a2f561bb5e80e75d38924b2f587fff4ccf0099d586c4753988ea71eb856

    SHA512

    d3ba5047d3c4b9f837dcbab1f01b5d84d69e7ea34ffe30851c26b2ae0838f46bd279b031c6487d584885a378988cf47bc86c1286ce196d3fe75aaeb19342e634

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\b6808541a60db5b65164df9da5bc91c3_JaffaCakes118-0CB8.exe
    Filesize

    222KB

    MD5

    5a8222c703b4a34f2227a652a49a2827

    SHA1

    ba8b1c8f341219d608a0a5a2a2c8d63c19697d05

    SHA256

    17936188efac05a0ef9fd87a79b268445ce307dd37a6f9206d116f195ab049c9

    SHA512

    7b1c200cf96ebb5b660fb11a85e3daf908a6e4d984c90207b5afa2444703fc784897160cf05a4bc592ecd908bf09f8dbd9195a4c0c07f1caef04bbd7c6624d9d

    Download Submit