1ef7db195fc7d94d8761d52f07b57f9e284dae1008af96fea13ec96f205c8ce7

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe
Size

293KB
MD5

d86f9b4228662e425a24fd1c13617087
SHA1

0203e3d73b79d1560c9cb793241b0cb7a9686974
SHA256

1ef7db195fc7d94d8761d52f07b57f9e284dae1008af96fea13ec96f205c8ce7
SHA512

252cb4d558abe39c00ad4b89556ed3c4eddb6315ecf2e83198156997e01dedd078633bebae396435cbf8c29892e6f7bd1180bd94de18c682889b145125f06928
SSDEEP

6144:bPdM9MANEVzGlcEDUl4qaRYVQLJTGbusJRhgnGXcLD7Xm2BeddhMHAO+9d:wNEh8cSLqdIsisDhgnG4BBedDMgO+P

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1244	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
328	muere.exe

Loads dropped DLL 2 IoCs

pid	Process
2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe
2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\{F5C6EAE8-1B61-AD4F-A81D-915899A2B245} = "C:\\Users\\Admin\\AppData\\Roaming\\Ikohf\\muere.exe"	muere.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	muere.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Privacy	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe
328	muere.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe
Token: SeSecurityPrivilege	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe
Token: SeSecurityPrivilege	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe
328	muere.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 328	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	31
PID 2536 wrote to memory of 328	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	31
PID 2536 wrote to memory of 328	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	31
PID 2536 wrote to memory of 328	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	31
PID 328 wrote to memory of 1104	328	muere.exe	19
PID 328 wrote to memory of 1104	328	muere.exe	19
PID 328 wrote to memory of 1104	328	muere.exe	19
PID 328 wrote to memory of 1104	328	muere.exe	19
PID 328 wrote to memory of 1104	328	muere.exe	19
PID 328 wrote to memory of 1172	328	muere.exe	20
PID 328 wrote to memory of 1172	328	muere.exe	20
PID 328 wrote to memory of 1172	328	muere.exe	20
PID 328 wrote to memory of 1172	328	muere.exe	20
PID 328 wrote to memory of 1172	328	muere.exe	20
PID 328 wrote to memory of 1252	328	muere.exe	21
PID 328 wrote to memory of 1252	328	muere.exe	21
PID 328 wrote to memory of 1252	328	muere.exe	21
PID 328 wrote to memory of 1252	328	muere.exe	21
PID 328 wrote to memory of 1252	328	muere.exe	21
PID 328 wrote to memory of 1656	328	muere.exe	25
PID 328 wrote to memory of 1656	328	muere.exe	25
PID 328 wrote to memory of 1656	328	muere.exe	25
PID 328 wrote to memory of 1656	328	muere.exe	25
PID 328 wrote to memory of 1656	328	muere.exe	25
PID 328 wrote to memory of 2536	328	muere.exe	30
PID 328 wrote to memory of 2536	328	muere.exe	30
PID 328 wrote to memory of 2536	328	muere.exe	30
PID 328 wrote to memory of 2536	328	muere.exe	30
PID 328 wrote to memory of 2536	328	muere.exe	30
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32
PID 2536 wrote to memory of 1244	2536	d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe	32

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Users\Admin\AppData\Local\Temp\d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d86f9b4228662e425a24fd1c13617087_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Roaming\Ikohf\muere.exe
    "C:\Users\Admin\AppData\Roaming\Ikohf\muere.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf6c044e5.bat"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:1244

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpf6c044e5.bat

Filesize
271B

MD5
004824f58cca53644ebbd2d94452a15c

SHA1
ac1d8beb63524212e73eb526c1c271b63900a4ee

SHA256
4c891ba45b033d4d130e4ffd7a4aa723a939cf9532e669c114544d528d234e28

SHA512
9708eb5c4008e9c4205a55c7ccca61f4013c706add235ba3d53555e4bf93d16e3f49da81f818d9328843b025b3664faac6dd5a4e3adbc371dc41450029f127b2

Download Submit
C:\Users\Admin\AppData\Roaming\Ylti\koyb.idq

Filesize
380B

MD5
769d1daa775800815ffe54af3300e86c

SHA1
ee8f0da1410a958cac103c1a1b1819202e1b5afb

SHA256
963920951b00a3bb188bee297292b44772122253ee1d5b6ff91973d444b697f5

SHA512
bf23a959f23f7a225b4f6ae16072c7129bb923f1085614dc0e73cd36d8f69e81274ca5086c64cc11ff21f5051a77307139e094c289ddf57d9c76db4a0c1d518f

Download Submit
\Users\Admin\AppData\Roaming\Ikohf\muere.exe

Filesize
293KB

MD5
13738318dea8d42f3747b29050bfeff3

SHA1
2a316cca9e0cf05ab962e2425ffe2fa795a5c3dd

SHA256
307e4e1cc572b21b90496d1179113c4c3025c5db2db8bd22b05434d8e7096603

SHA512
b49c2db165ea901617bfa4939efd5287474c4fbe67baeba62a110930cf3f4154f5914961c156e8c9089994777f855c9c1fb72a6b2ed3750ba7c23f22fa4d0b2b

Download Submit
memory/328-18-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/328-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/328-16-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/328-17-0x0000000000370000-0x00000000003BB000-memory.dmp

Filesize
300KB

Download
memory/1104-21-0x00000000001B0000-0x00000000001F1000-memory.dmp

Filesize
260KB

Download
memory/1104-23-0x00000000001B0000-0x00000000001F1000-memory.dmp

Filesize
260KB

Download
memory/1104-19-0x00000000001B0000-0x00000000001F1000-memory.dmp

Filesize
260KB

Download
memory/1104-27-0x00000000001B0000-0x00000000001F1000-memory.dmp

Filesize
260KB

Download
memory/1104-25-0x00000000001B0000-0x00000000001F1000-memory.dmp

Filesize
260KB

Download
memory/1172-31-0x00000000020B0000-0x00000000020F1000-memory.dmp

Filesize
260KB

Download
memory/1172-37-0x00000000020B0000-0x00000000020F1000-memory.dmp

Filesize
260KB

Download
memory/1172-35-0x00000000020B0000-0x00000000020F1000-memory.dmp

Filesize
260KB

Download
memory/1172-33-0x00000000020B0000-0x00000000020F1000-memory.dmp

Filesize
260KB

Download
memory/1252-41-0x0000000002E70000-0x0000000002EB1000-memory.dmp

Filesize
260KB

Download
memory/1252-42-0x0000000002E70000-0x0000000002EB1000-memory.dmp

Filesize
260KB

Download
memory/1252-43-0x0000000002E70000-0x0000000002EB1000-memory.dmp

Filesize
260KB

Download
memory/1252-40-0x0000000002E70000-0x0000000002EB1000-memory.dmp

Filesize
260KB

Download
memory/1656-48-0x0000000001F40000-0x0000000001F81000-memory.dmp

Filesize
260KB

Download
memory/1656-46-0x0000000001F40000-0x0000000001F81000-memory.dmp

Filesize
260KB

Download
memory/1656-50-0x0000000001F40000-0x0000000001F81000-memory.dmp

Filesize
260KB

Download
memory/1656-52-0x0000000001F40000-0x0000000001F81000-memory.dmp

Filesize
260KB

Download
memory/2536-57-0x0000000001D30000-0x0000000001D71000-memory.dmp

Filesize
260KB

Download
memory/2536-66-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-82-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-78-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-69-0x0000000077A50000-0x0000000077A51000-memory.dmp

Filesize
4KB

Download
memory/2536-68-0x0000000001D30000-0x0000000001D71000-memory.dmp

Filesize
260KB

Download
memory/2536-64-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-62-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-60-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-70-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-72-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-74-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-76-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-80-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-55-0x0000000001D30000-0x0000000001D71000-memory.dmp

Filesize
260KB

Download
memory/2536-56-0x0000000001D30000-0x0000000001D71000-memory.dmp

Filesize
260KB

Download
memory/2536-0-0x0000000001B70000-0x0000000001BB1000-memory.dmp

Filesize
260KB

Download
memory/2536-58-0x0000000001D30000-0x0000000001D71000-memory.dmp

Filesize
260KB

Download
memory/2536-59-0x0000000001D30000-0x0000000001D71000-memory.dmp

Filesize
260KB

Download
memory/2536-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-141-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2536-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-166-0x0000000001D30000-0x0000000001D71000-memory.dmp

Filesize
260KB

Download
memory/2536-165-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-4-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-1-0x0000000001BC0000-0x0000000001C0B000-memory.dmp

Filesize
300KB

Download