995969be9fc2c3e50687f7e6a852288feed4d3726eab57bd7cdcb45ff7be7091

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe
Size

321KB
MD5

b7ae676bab048adebb98eb8521c72302
SHA1

fa10aec49e954ccd21de4f514958af3a066d121c
SHA256

995969be9fc2c3e50687f7e6a852288feed4d3726eab57bd7cdcb45ff7be7091
SHA512

b94f7299dce2aef54ae2fc49f48fc1c72b778b1b5a4e2ac65e5b05459aab994a9a4faf2d2234188c493ee63296fde6df811e9009d89757341003b6193e7f4efd
SSDEEP

6144:vT+FQoCd72swMHScIOq1G/PvRnC2CkErfos:CFhCzycBqwvRC2gcs

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2300	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1744	ozic.exe

Loads dropped DLL 2 IoCs

pid	Process
2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe
2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\{278F5008-6814-AD4F-E8EF-460FE6556512} = "C:\\Users\\Admin\\AppData\\Roaming\\Astyba\\ozic.exe"	ozic.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ozic.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Privacy	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe
1744	ozic.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe
1744	ozic.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1744	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	31
PID 2860 wrote to memory of 1744	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	31
PID 2860 wrote to memory of 1744	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	31
PID 2860 wrote to memory of 1744	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	31
PID 1744 wrote to memory of 1048	1744	ozic.exe	17
PID 1744 wrote to memory of 1048	1744	ozic.exe	17
PID 1744 wrote to memory of 1048	1744	ozic.exe	17
PID 1744 wrote to memory of 1048	1744	ozic.exe	17
PID 1744 wrote to memory of 1048	1744	ozic.exe	17
PID 1744 wrote to memory of 1056	1744	ozic.exe	18
PID 1744 wrote to memory of 1056	1744	ozic.exe	18
PID 1744 wrote to memory of 1056	1744	ozic.exe	18
PID 1744 wrote to memory of 1056	1744	ozic.exe	18
PID 1744 wrote to memory of 1056	1744	ozic.exe	18
PID 1744 wrote to memory of 1124	1744	ozic.exe	20
PID 1744 wrote to memory of 1124	1744	ozic.exe	20
PID 1744 wrote to memory of 1124	1744	ozic.exe	20
PID 1744 wrote to memory of 1124	1744	ozic.exe	20
PID 1744 wrote to memory of 1124	1744	ozic.exe	20
PID 1744 wrote to memory of 1472	1744	ozic.exe	25
PID 1744 wrote to memory of 1472	1744	ozic.exe	25
PID 1744 wrote to memory of 1472	1744	ozic.exe	25
PID 1744 wrote to memory of 1472	1744	ozic.exe	25
PID 1744 wrote to memory of 1472	1744	ozic.exe	25
PID 1744 wrote to memory of 2860	1744	ozic.exe	30
PID 1744 wrote to memory of 2860	1744	ozic.exe	30
PID 1744 wrote to memory of 2860	1744	ozic.exe	30
PID 1744 wrote to memory of 2860	1744	ozic.exe	30
PID 1744 wrote to memory of 2860	1744	ozic.exe	30
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2300	2860	b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe	32
PID 1744 wrote to memory of 1728	1744	ozic.exe	34
PID 1744 wrote to memory of 1728	1744	ozic.exe	34
PID 1744 wrote to memory of 1728	1744	ozic.exe	34
PID 1744 wrote to memory of 1728	1744	ozic.exe	34
PID 1744 wrote to memory of 1728	1744	ozic.exe	34

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1048

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1056

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1124
- C:\Users\Admin\AppData\Local\Temp\b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b7ae676bab048adebb98eb8521c72302_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Roaming\Astyba\ozic.exe
    "C:\Users\Admin\AppData\Roaming\Astyba\ozic.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp96f6c0c3.bat"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2300

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1472

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp96f6c0c3.bat

Filesize
271B

MD5
edeb80fe18b9a3faf394051a77cc0f23

SHA1
34024ef3e388295ed9594d2494e722ea4b50890a

SHA256
5311e7c34db166d9b9b5eff0c4f0e6d8966b383bbb102310d5839cdd519e5665

SHA512
2ed97548de2a9ad11d282aa0a93413965cdebb90e4a68ac4bee1b469e786911990bc11b09232bb004095635727f9bc19dd734bfa46a43f0b2ee75870bf37ed31

Download Submit
C:\Users\Admin\AppData\Roaming\Astyba\ozic.exe

Filesize
321KB

MD5
7b5d4f11b5330ad820d21dac0f150b78

SHA1
97f9eda82a0599ec01c4012305bf9e24867543a5

SHA256
1e5ac7c2d5ddf98f20e4db3cc0e0b1ddbfcb30c7c5159ce613bdbba06c5f1e33

SHA512
f0d8359214408041d8000098044d36502e8c6b5b3e73a47a086c61832ad45ff2012228d015983bf570d11670ea80b352a7779ac1e964308e34aa86b5802024c2

Download Submit
memory/1048-19-0x00000000022A0000-0x00000000022E4000-memory.dmp

Filesize
272KB

Download
memory/1048-23-0x00000000022A0000-0x00000000022E4000-memory.dmp

Filesize
272KB

Download
memory/1048-25-0x00000000022A0000-0x00000000022E4000-memory.dmp

Filesize
272KB

Download
memory/1048-21-0x00000000022A0000-0x00000000022E4000-memory.dmp

Filesize
272KB

Download
memory/1048-27-0x00000000022A0000-0x00000000022E4000-memory.dmp

Filesize
272KB

Download
memory/1056-30-0x0000000001F80000-0x0000000001FC4000-memory.dmp

Filesize
272KB

Download
memory/1056-34-0x0000000001F80000-0x0000000001FC4000-memory.dmp

Filesize
272KB

Download
memory/1056-32-0x0000000001F80000-0x0000000001FC4000-memory.dmp

Filesize
272KB

Download
memory/1056-31-0x0000000001F80000-0x0000000001FC4000-memory.dmp

Filesize
272KB

Download
memory/1124-38-0x0000000002EE0000-0x0000000002F24000-memory.dmp

Filesize
272KB

Download
memory/1124-39-0x0000000002EE0000-0x0000000002F24000-memory.dmp

Filesize
272KB

Download
memory/1124-37-0x0000000002EE0000-0x0000000002F24000-memory.dmp

Filesize
272KB

Download
memory/1124-40-0x0000000002EE0000-0x0000000002F24000-memory.dmp

Filesize
272KB

Download
memory/1472-45-0x0000000001CF0000-0x0000000001D34000-memory.dmp

Filesize
272KB

Download
memory/1472-42-0x0000000001CF0000-0x0000000001D34000-memory.dmp

Filesize
272KB

Download
memory/1472-43-0x0000000001CF0000-0x0000000001D34000-memory.dmp

Filesize
272KB

Download
memory/1472-44-0x0000000001CF0000-0x0000000001D34000-memory.dmp

Filesize
272KB

Download
memory/1744-16-0x0000000000360000-0x00000000003B6000-memory.dmp

Filesize
344KB

Download
memory/1744-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1744-15-0x0000000000280000-0x00000000002C4000-memory.dmp

Filesize
272KB

Download
memory/1744-285-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2860-80-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-70-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-56-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-54-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-52-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-51-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Filesize
272KB

Download
memory/2860-50-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Filesize
272KB

Download
memory/2860-49-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Filesize
272KB

Download
memory/2860-48-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Filesize
272KB

Download
memory/2860-47-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Filesize
272KB

Download
memory/2860-60-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-62-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-64-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-66-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-68-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-58-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-72-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-74-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-76-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-78-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-1-0x00000000003A0000-0x00000000003F6000-memory.dmp

Filesize
344KB

Download
memory/2860-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2860-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2860-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2860-138-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2860-137-0x0000000077CB0000-0x0000000077CB1000-memory.dmp

Filesize
4KB

Download
memory/2860-136-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Filesize
272KB

Download
memory/2860-163-0x0000000001F70000-0x0000000001FB4000-memory.dmp

Filesize
272KB

Download
memory/2860-162-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2860-161-0x00000000003A0000-0x00000000003F6000-memory.dmp

Filesize
344KB

Download
memory/2860-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2860-0-0x0000000000290000-0x00000000002D4000-memory.dmp

Filesize
272KB

Download