fd9021843bc9362c40f43396d9d207f9b3a69d5ccf07a31cf74bbff3f9d301b7

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
Size

265KB
MD5

c8d91b37467bbd34b0d5f4b267c5bc17
SHA1

8f0023dc7ce1954d9a2af35b4449fb089b88630a
SHA256

fd9021843bc9362c40f43396d9d207f9b3a69d5ccf07a31cf74bbff3f9d301b7
SHA512

e3dc196a4cc6490521fd62cdfcd7094763a6bc10cd7e9f5267f735ef0e8fa8ed18577eaa17a35666ea00c75d4875dc01001a13afbc85bdbfa391223b2bff5820
SSDEEP

6144:P4K38G5g3U6R4W8lrUzTQb+atp5Hz46YXQv2ZQz5kjSTB0dMUxYKN:pGTOUzMyuzHzUAv75k2C1

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2440	awebf.exe

Loads dropped DLL 2 IoCs

pid	Process
2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\{75DA6328-6F30-AD4F-96DD-2BAD86C808B0} = "C:\\Users\\Admin\\AppData\\Roaming\\Kifico\\awebf.exe"	awebf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	awebf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Privacy	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe
2440	awebf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
Token: SeSecurityPrivilege	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
Token: SeSecurityPrivilege	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
2440	awebf.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2440	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2440	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2440	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	29
PID 2556 wrote to memory of 2440	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	29
PID 2440 wrote to memory of 1188	2440	awebf.exe	18
PID 2440 wrote to memory of 1188	2440	awebf.exe	18
PID 2440 wrote to memory of 1188	2440	awebf.exe	18
PID 2440 wrote to memory of 1188	2440	awebf.exe	18
PID 2440 wrote to memory of 1188	2440	awebf.exe	18
PID 2440 wrote to memory of 1284	2440	awebf.exe	19
PID 2440 wrote to memory of 1284	2440	awebf.exe	19
PID 2440 wrote to memory of 1284	2440	awebf.exe	19
PID 2440 wrote to memory of 1284	2440	awebf.exe	19
PID 2440 wrote to memory of 1284	2440	awebf.exe	19
PID 2440 wrote to memory of 1344	2440	awebf.exe	20
PID 2440 wrote to memory of 1344	2440	awebf.exe	20
PID 2440 wrote to memory of 1344	2440	awebf.exe	20
PID 2440 wrote to memory of 1344	2440	awebf.exe	20
PID 2440 wrote to memory of 1344	2440	awebf.exe	20
PID 2440 wrote to memory of 1512	2440	awebf.exe	22
PID 2440 wrote to memory of 1512	2440	awebf.exe	22
PID 2440 wrote to memory of 1512	2440	awebf.exe	22
PID 2440 wrote to memory of 1512	2440	awebf.exe	22
PID 2440 wrote to memory of 1512	2440	awebf.exe	22
PID 2440 wrote to memory of 2556	2440	awebf.exe	28
PID 2440 wrote to memory of 2556	2440	awebf.exe	28
PID 2440 wrote to memory of 2556	2440	awebf.exe	28
PID 2440 wrote to memory of 2556	2440	awebf.exe	28
PID 2440 wrote to memory of 2556	2440	awebf.exe	28
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2816	2556	c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe	30

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1188

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1284

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1344
- C:\Users\Admin\AppData\Local\Temp\c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c8d91b37467bbd34b0d5f4b267c5bc17_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Roaming\Kifico\awebf.exe
    "C:\Users\Admin\AppData\Roaming\Kifico\awebf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2d78c70c.bat"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2816

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2d78c70c.bat

Filesize
271B

MD5
999e8fa7e129993fc95adfcf1bc827a5

SHA1
74533817471a19a2bbc25bc661c8f3f6f6b6df52

SHA256
75a882e2fb6824bd39e9a7bc7c0f9e99b564f74c93a7156aba2f17a0ed0ba9f1

SHA512
d6d371472f924c619356cad313e607db504bd9f454faad841882bbad76d974d07f30ec02c02665fbf8fc38a1f2932dcca3aa7ba857a022122a1319ac4b7033af

Download Submit
C:\Users\Admin\AppData\Roaming\Houp\uduh.zue

Filesize
380B

MD5
fd611dca68f4e613393d6c8b52469b05

SHA1
12f3c368e11255fcd88598a90f68e7c6b710a2da

SHA256
9cc538f37ffc9b2c196dfa99f2b85976a7c97eed9de797e8c30bcd041bd2b637

SHA512
2489c2a1b499fe80cbecbd4774dd4f7c9a669f7f29235b1d67e612e0a38239a8f73423eab126838be7b023f07b205c89f538f9a5fe2f4f0d2ca08448c7232435

Download Submit
\Users\Admin\AppData\Roaming\Kifico\awebf.exe

Filesize
265KB

MD5
b843ac6962178ba3c8373b34c78db268

SHA1
cc0bb9efc516bd77debc5511949ba94db3b60e6d

SHA256
425938e141a8a7ab207b80637a74f9d893851e51a54c00886cab02797ed78db8

SHA512
53bcba5c3d7f51d2453431f13deca801313da5f4316ca8a9271b4010d1116c9ac3dd1679aed8119ccb9eb1c25dbcd9bd03ac4641a5bba097023aef37cfd99e08

Download Submit
memory/1188-18-0x0000000001DE0000-0x0000000001E21000-memory.dmp

Filesize
260KB

Download
memory/1188-21-0x0000000001DE0000-0x0000000001E21000-memory.dmp

Filesize
260KB

Download
memory/1188-19-0x0000000001DE0000-0x0000000001E21000-memory.dmp

Filesize
260KB

Download
memory/1188-22-0x0000000001DE0000-0x0000000001E21000-memory.dmp

Filesize
260KB

Download
memory/1188-20-0x0000000001DE0000-0x0000000001E21000-memory.dmp

Filesize
260KB

Download
memory/1284-24-0x0000000001AC0000-0x0000000001B01000-memory.dmp

Filesize
260KB

Download
memory/1284-26-0x0000000001AC0000-0x0000000001B01000-memory.dmp

Filesize
260KB

Download
memory/1284-25-0x0000000001AC0000-0x0000000001B01000-memory.dmp

Filesize
260KB

Download
memory/1284-27-0x0000000001AC0000-0x0000000001B01000-memory.dmp

Filesize
260KB

Download
memory/1344-29-0x00000000025F0000-0x0000000002631000-memory.dmp

Filesize
260KB

Download
memory/1344-30-0x00000000025F0000-0x0000000002631000-memory.dmp

Filesize
260KB

Download
memory/1344-31-0x00000000025F0000-0x0000000002631000-memory.dmp

Filesize
260KB

Download
memory/1344-32-0x00000000025F0000-0x0000000002631000-memory.dmp

Filesize
260KB

Download
memory/1512-34-0x0000000001E40000-0x0000000001E81000-memory.dmp

Filesize
260KB

Download
memory/1512-37-0x0000000001E40000-0x0000000001E81000-memory.dmp

Filesize
260KB

Download
memory/1512-36-0x0000000001E40000-0x0000000001E81000-memory.dmp

Filesize
260KB

Download
memory/1512-35-0x0000000001E40000-0x0000000001E81000-memory.dmp

Filesize
260KB

Download
memory/2440-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2440-274-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2440-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2440-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2556-130-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-70-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-66-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-64-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-62-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-60-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-58-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-56-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-54-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-52-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-48-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-46-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-44-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-43-0x00000000004A0000-0x00000000004E1000-memory.dmp

Filesize
260KB

Download
memory/2556-42-0x00000000004A0000-0x00000000004E1000-memory.dmp

Filesize
260KB

Download
memory/2556-41-0x00000000004A0000-0x00000000004E1000-memory.dmp

Filesize
260KB

Download
memory/2556-39-0x00000000004A0000-0x00000000004E1000-memory.dmp

Filesize
260KB

Download
memory/2556-68-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-72-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-148-0x0000000000370000-0x00000000003B6000-memory.dmp

Filesize
280KB

Download
memory/2556-149-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-150-0x00000000004A0000-0x00000000004E1000-memory.dmp

Filesize
260KB

Download
memory/2556-74-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-76-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-78-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-1-0x0000000000370000-0x00000000003B6000-memory.dmp

Filesize
280KB

Download
memory/2556-128-0x00000000004A0000-0x00000000004E1000-memory.dmp

Filesize
260KB

Download
memory/2556-129-0x0000000077530000-0x0000000077531000-memory.dmp

Filesize
4KB

Download
memory/2556-50-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2556-40-0x00000000004A0000-0x00000000004E1000-memory.dmp

Filesize
260KB

Download
memory/2556-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-4-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-0-0x0000000000260000-0x00000000002A1000-memory.dmp

Filesize
260KB

Download