1aa8d41eb19116f0ece101067494bd602a78ac30c8dfa194b24ae0b444eb73fc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
Size

16KB
MD5

eabbc08a8189ea8dde19c9506688f59d
SHA1

1105140d0052f99a9e97bc5f6384fde7e80c41ed
SHA256

1aa8d41eb19116f0ece101067494bd602a78ac30c8dfa194b24ae0b444eb73fc
SHA512

57539fd1eedba509e262fe8a148bb1b23d3cbb9f9bae2ece0e9efdddfaadf59082d4dc57fb80ca95f0f813ba00d8bfca824f2a46bac41e779a44c44ed4ee18f4
SSDEEP

384:ruYgL+iWP3hgE7Q2BhMfVAgtCwLYU50U9gsZjH:XFhH7fMf6PwLYoVH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1640	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	coiome.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\safety = "C:\\Program Files\\Common Files\\sessavx\\coiome.exe"	mshta.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PEL.hta	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\sessavx\coiome.exe	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\sessavx\coiome.exe	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\sessavx	coiome.exe
File opened for modification	C:\Program Files (x86)\Common Files\sessavx	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coiome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2556	taskkill.exe
2384	taskkill.exe
2476	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.52cailing.com"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\default_page_url = "http://www.52cailing.com"	mshta.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.52cailing.com"	mshta.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2664	coiome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2400	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2400	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2400	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2400	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2148	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2148	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2148	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2148	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	31
PID 2520 wrote to memory of 2508	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2508	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2508	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2508	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2384	2148	cmd.exe	35
PID 2148 wrote to memory of 2384	2148	cmd.exe	35
PID 2148 wrote to memory of 2384	2148	cmd.exe	35
PID 2148 wrote to memory of 2384	2148	cmd.exe	35
PID 2508 wrote to memory of 2556	2508	cmd.exe	36
PID 2508 wrote to memory of 2556	2508	cmd.exe	36
PID 2508 wrote to memory of 2556	2508	cmd.exe	36
PID 2508 wrote to memory of 2556	2508	cmd.exe	36
PID 2520 wrote to memory of 2724	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	38
PID 2520 wrote to memory of 2724	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	38
PID 2520 wrote to memory of 2724	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	38
PID 2520 wrote to memory of 2724	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	38
PID 2724 wrote to memory of 2476	2724	cmd.exe	40
PID 2724 wrote to memory of 2476	2724	cmd.exe	40
PID 2724 wrote to memory of 2476	2724	cmd.exe	40
PID 2724 wrote to memory of 2476	2724	cmd.exe	40
PID 2520 wrote to memory of 2664	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	42
PID 2520 wrote to memory of 2664	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	42
PID 2520 wrote to memory of 2664	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	42
PID 2520 wrote to memory of 2664	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	42
PID 2520 wrote to memory of 1640	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	43
PID 2520 wrote to memory of 1640	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	43
PID 2520 wrote to memory of 1640	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	43
PID 2520 wrote to memory of 1640	2520	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	43
PID 2664 wrote to memory of 2868	2664	coiome.exe	46
PID 2664 wrote to memory of 2868	2664	coiome.exe	46
PID 2664 wrote to memory of 2868	2664	coiome.exe	46
PID 2664 wrote to memory of 2868	2664	coiome.exe	46
PID 2868 wrote to memory of 1792	2868	cmd.exe	48
PID 2868 wrote to memory of 1792	2868	cmd.exe	48
PID 2868 wrote to memory of 1792	2868	cmd.exe	48
PID 2868 wrote to memory of 1792	2868	cmd.exe	48
PID 2664 wrote to memory of 1864	2664	coiome.exe	49
PID 2664 wrote to memory of 1864	2664	coiome.exe	49
PID 2664 wrote to memory of 1864	2664	coiome.exe	49
PID 2664 wrote to memory of 1864	2664	coiome.exe	49
PID 1864 wrote to memory of 268	1864	cmd.exe	51
PID 1864 wrote to memory of 268	1864	cmd.exe	51
PID 1864 wrote to memory of 268	1864	cmd.exe	51
PID 1864 wrote to memory of 268	1864	cmd.exe	51
PID 2664 wrote to memory of 2792	2664	coiome.exe	52
PID 2664 wrote to memory of 2792	2664	coiome.exe	52
PID 2664 wrote to memory of 2792	2664	coiome.exe	52
PID 2664 wrote to memory of 2792	2664	coiome.exe	52
PID 2664 wrote to memory of 1044	2664	coiome.exe	54
PID 2664 wrote to memory of 1044	2664	coiome.exe	54
PID 2664 wrote to memory of 1044	2664	coiome.exe	54
PID 2664 wrote to memory of 1044	2664	coiome.exe	54
PID 2664 wrote to memory of 2004	2664	coiome.exe	56
PID 2664 wrote to memory of 2004	2664	coiome.exe	56
PID 2664 wrote to memory of 2004	2664	coiome.exe	56
PID 2664 wrote to memory of 2004	2664	coiome.exe	56

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
268	attrib.exe
1792	attrib.exe

C:\Users\Admin\AppData\Local\Temp\eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\PEL.hta"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im cfmon.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im cfmon.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im conlme.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im conlme.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im coiome.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im coiome.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\Program Files (x86)\Common Files\sessavx\coiome.exe
  "C:\Program Files (x86)\Common Files\sessavx\coiome.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Cookies\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Cookies\*.*"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Local Settings\Temp\Cookies\*.*"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Cookies\*.*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PEL.hta

Filesize
802B

MD5
8e0f805db5152f19ff8ddf203d93c3c1

SHA1
61d56c813de36bf08061497d28e99ad4cf6de84b

SHA256
c1035fb0a6516503223377252502a3de41e6a7337dbc25b1b503d6d72eff6f8b

SHA512
6d374479d9b8b3c9d3b46fea918dd36832b5438896131bd9b9844e6b9dedc6156098769fefc8efc1e5efc10fb9a0081c8eb44502035609345e43c379cbb0198f

Download Submit
\Program Files (x86)\Common Files\sessavx\coiome.exe

Filesize
12.0MB

MD5
0c35045f8b1c3e4bf1a8104289fd3eb2

SHA1
001f06c2b62319da3691b2e55bb08a385f53ff97

SHA256
cb18d0c8939b7311ee41ffd1eee2da230371ce61d939013040991a47a4720085

SHA512
46a9cb26513e3c15284c081c9cf07bc5791fa94c663900bb05f7db9be63540b70eb99ebcf68e2651907cddfdd966cd3af0e09a1414deb24eb91d2db451a8a394

Download Submit
memory/2520-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2520-7-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2520-15-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/2520-14-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/2520-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2664-17-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2664-19-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads