e1e69f5eb3d6533bb0444e04c8cf2f2866606c2a1072b2a1231ced158d397c28

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
Size

3.0MB
MD5

9e6ce2f2bb792773a63174608af650e6
SHA1

ee2cd53f658c610aaa0c67c363448f8182f530a2
SHA256

e1e69f5eb3d6533bb0444e04c8cf2f2866606c2a1072b2a1231ced158d397c28
SHA512

8b65f17aea99eaa3a7ef83b8773e017f6c5082ca9d642ebc3da5dfc990a30447d0c8eb0a0af4f0cb5e432691329cb8fdba4680d1fd438841b0c4f5b9fbae16dc
SSDEEP

49152:gd1Px3WPeLBC99GK2EMFAz3qB2/b5OR9/qi6jjfU+VmqNhaypYawkHIWKPJWP:yxWPeLjKHeo/gRwi6cYuyouHK4P

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\SmShAs = "C:\\Program Files (x86)\\Seemao\\app\\seemao\\seemao.exe"	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Seemao\app\seemao\PluginLogger.dll	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\PluginSearcher.dll	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\bugreport.exe	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\PluginATLBrowser.dll	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\PluginUI.dll	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\PluginUpdate.dll	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\seemao.exe	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\1	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\uninst.exe	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Seemao\app\seemao\PluginDownloader.dll	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2988	9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e6ce2f2bb792773a63174608af650e6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\seemao\config\map\www.shihui.cn.html

Filesize
2B

MD5
54cafa3a6d69c189cf2df3978fbdd435

SHA1
ab34955f0a30619fc4faa49013902031d85ddc46

SHA256
e12a7e051731cf1dbeefa2142a8e1abb1eb5898e2cbe4aa522120829a5588dc7

SHA512
43e539801d00eb39811341d67327e0e8b7d97677e08c8cd14d501c1276592a80dcc0983306f292c702a7553d34bad9fa768cf9d046059c3a4b2a1a0a892f9410

Download Submit
C:\ProgramData\seemao\config\map\www.xinhuabookstore.com.html

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
\Program Files (x86)\Seemao\app\seemao\seemao.exe

Filesize
411KB

MD5
bcc0a0161e1b99339c1de38cab20ff23

SHA1
2c06fb770e3f5bb9ef018cd7b61136db3db3668a

SHA256
64579be93129cec5a95b708c112d96ccbff351e08b949ea4c6563db84e18c16b

SHA512
d9dabc87109c7616749b5dcf59468749a5f36066c5bf077723af9d9ef635ab22856c4527defe4550aacef133d5077f41c04a784ab603faba1d0fce38542eea05

Download Submit
\ProgramData\seemao\config\Common.dll

Filesize
143KB

MD5
8ba8f8d6ed4db7976c4f1aadf0b0ca88

SHA1
1e82e56af2bfd37ee91a795f36fefc7a2a50cf9b

SHA256
27479ff989fa49cedc4fa80b3733f44df3630b621211235ac10706276b398322

SHA512
10c57d7db153489e3c0b3e2e6c7edd7d364b7e9b9400922e1febd6310aa2a1313ccb18b1b845fe20adb808a89d24a8a721c09f63f753688c33df608f48e31f73

Download Submit
\Users\Admin\AppData\Local\Temp\nsd8650.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
\Users\Admin\AppData\Local\Temp\nsd8650.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nsd8650.tmp\inetc.dll

Filesize
20KB

MD5
134b93f8bd1f82cd2f1b06c878580703

SHA1
29cdbce7a2caf1f7e4d2a139c42336d490074665

SHA256
45153adf50541316468e2b189a0f8127be9fb29e2f920e7eeaa6aceb438db8c4

SHA512
f970c38debb6631dab7369e2bc96237f16a8fd328d9d35a2b54cb688e1807f62cc6d63230afe89ce5c3945097ae4466872c72929a9623adde3ee57bddf54b692

Download Submit
\Users\Admin\AppData\Local\Temp\nsd8650.tmp\xml.dll

Filesize
118KB

MD5
42df1fbaa87567adf2b4050805a1a545

SHA1
b892a6efbb39b7144248e0c0d79e53da474a9373

SHA256
e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

SHA512
4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

Download Submit
memory/2988-506-0x0000000000650000-0x0000000000673000-memory.dmp

Filesize
140KB

Download
memory/2988-528-0x0000000000650000-0x0000000000671000-memory.dmp

Filesize
132KB

Download
memory/2988-539-0x0000000002BC0000-0x0000000002BE1000-memory.dmp

Filesize
132KB

Download