Overview
overview
7Static
static
3c12e258275...18.exe
windows7-x64
7c12e258275...18.exe
windows10-2004-x64
7$PLUGINSDI...ig.dll
windows7-x64
3$PLUGINSDI...ig.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3IETab.dll
windows7-x64
6IETab.dll
windows10-2004-x64
6IETab.exe
windows7-x64
6IETab.exe
windows10-2004-x64
6IETabHelper.dll
windows7-x64
3IETabHelper.dll
windows10-2004-x64
3Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system - submitted
25/08/2024, 16:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
IETab.dll
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
IETab.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
IETab.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
IETab.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral15
Sample
IETabHelper.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
IETabHelper.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe
- Size 328KB
- Sample240825-vhdb5avalb
- SHA256 fa9c85f956773b5c1430b2cab5986a5e7465664efe49161d1fa530b9daafc124
- MD5 c12e258275265c646e5949c6da18f29c
- SHA1 84797d63f542f9131333af42b2d85544b1dd9356
- SHA512 09d233d79d9b989b633df5de6f3a9d17cfb972bbad8233a3430f9fd8e18a9dcc80e3fe8d3b79e586ace254f41c96ed8fedf2c8cc55e19e10e07857a9dc893145
- SSDEEP 6144:Me34COl75+ZPPfnE2Qyn20UK1fGGhmudYDXRXR6vaVXS/YOr75+ZPPfnE2Qyn20e:pKF+ZPPfnEUnxZGGMud6B6SVXSAGF+Zm
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2764 IETab.exe - Executes dropped EXE 1 IoCs
pid Process 2764 IETab.exe - Loads dropped DLL 8 IoCs
pid Process 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IETab = "\"C:\\Program Files (x86)\\IETab\\IETab.exe\"" c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IETab = "C:\\Program Files (x86)\\IETab\\IETab.exe" IETab.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\IETab\IETabHelper.dll c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe File created C:\Program Files (x86)\IETab\IETab.exe c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe File created C:\Program Files (x86)\IETab\Uninstall.exe c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IETab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 2764 IETab.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2764 IETab.exe 2764 IETab.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2824 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2824 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2824 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2824 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2824 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2824 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2824 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2828 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2828 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2828 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2828 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2828 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2828 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2828 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2812 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2812 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2812 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2812 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2812 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2812 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2812 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 32 PID 2852 wrote to memory of 2764 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 33 PID 2852 wrote to memory of 2764 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 33 PID 2852 wrote to memory of 2764 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 33 PID 2852 wrote to memory of 2764 2852 c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe 33 PID 2764 wrote to memory of 2480 2764 IETab.exe 35 PID 2764 wrote to memory of 2480 2764 IETab.exe 35 PID 2764 wrote to memory of 2480 2764 IETab.exe 35 PID 2764 wrote to memory of 2480 2764 IETab.exe 35 PID 2764 wrote to memory of 2480 2764 IETab.exe 35 PID 2764 wrote to memory of 2480 2764 IETab.exe 35 PID 2764 wrote to memory of 2480 2764 IETab.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c12e258275265c646e5949c6da18f29c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\WallTab\WallTab.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\SideTab\SideTab.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files (x86)\PostTip\PostTip.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2812
-
-
C:\Program Files (x86)\IETab\IETab.exe"C:\Program Files (x86)\IETab\IETab.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\IETab\IETab.dll"3⤵
- System Location Discovery: System Language Discovery
PID:2480
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Program Files (x86)\IETab\IETab.exe
- Size 130KB
- SHA256 4f51a3b11160c32f6b5bf66a544ba5a14b4bf9fd351e5d9086c8e5ea0af4fc07
- MD5 437506ca5d08c4393c9ee25d5ea752ff
- SHA1 01d0b29b052df9d566d080aa5268c5a5007fd5b6
- SHA512 abc73f91e783d7b8d211a15d214edf2d355ed9a78b922ac7a8080650ef0dded2aef9d45fec5d5809a3c862c4abb716da0a169e14522fb7d7a9302e2ee8de6ee6
- SSDEEP 1536:gjHgYTWp2qcCx3KOHEDZN/9JxfHXocRAbiLanaIfMrMnnPz7PtkgfT:gjHgV3KvDZN/9JNYcbLaaIfXnPz7PtpT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso2C9D.tmp\IpConfig.dll
- Size 114KB
- SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
- MD5 a3ed6f7ea493b9644125d494fbf9a1e6
- SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
- SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
- SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso2C9D.tmp\NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso2C9D.tmp\UAC.dll
- Size 13KB
- SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
- MD5 29858669d7da388d1e62b4fd5337af12
- SHA1 756b94898429a9025a04ae227f060952f1149a5f
- SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
- SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso2C9D.tmp\nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- MD5 SHA1 SHA512