1aa8d41eb19116f0ece101067494bd602a78ac30c8dfa194b24ae0b444eb73fc

Analysis

max time kernel
93s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
Size

16KB
MD5

eabbc08a8189ea8dde19c9506688f59d
SHA1

1105140d0052f99a9e97bc5f6384fde7e80c41ed
SHA256

1aa8d41eb19116f0ece101067494bd602a78ac30c8dfa194b24ae0b444eb73fc
SHA512

57539fd1eedba509e262fe8a148bb1b23d3cbb9f9bae2ece0e9efdddfaadf59082d4dc57fb80ca95f0f813ba00d8bfca824f2a46bac41e779a44c44ed4ee18f4
SSDEEP

384:ruYgL+iWP3hgE7Q2BhMfVAgtCwLYU50U9gsZjH:XFhH7fMf6PwLYoVH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1712	coiome.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\safety = "C:\\Program Files\\Common Files\\sessavx\\coiome.exe"	mshta.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\sessavx\coiome.exe	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\sessavx\coiome.exe	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\sessavx	coiome.exe
File opened for modification	C:\Program Files (x86)\Common Files\sessavx	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
File created	C:\Program Files (x86)\VGR.hta	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coiome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1272	taskkill.exe
2328	taskkill.exe
4936	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.52cailing.com"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\default_page_url = "http://www.52cailing.com"	mshta.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.52cailing.com"	mshta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	1712	coiome.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4612	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	85
PID 3572 wrote to memory of 4612	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	85
PID 3572 wrote to memory of 4612	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	85
PID 3572 wrote to memory of 4584	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	86
PID 3572 wrote to memory of 4584	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	86
PID 3572 wrote to memory of 4584	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	86
PID 3572 wrote to memory of 2228	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	87
PID 3572 wrote to memory of 2228	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	87
PID 3572 wrote to memory of 2228	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	87
PID 4584 wrote to memory of 2328	4584	cmd.exe	90
PID 4584 wrote to memory of 2328	4584	cmd.exe	90
PID 4584 wrote to memory of 2328	4584	cmd.exe	90
PID 2228 wrote to memory of 4936	2228	cmd.exe	91
PID 2228 wrote to memory of 4936	2228	cmd.exe	91
PID 2228 wrote to memory of 4936	2228	cmd.exe	91
PID 3572 wrote to memory of 5088	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	93
PID 3572 wrote to memory of 5088	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	93
PID 3572 wrote to memory of 5088	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	93
PID 5088 wrote to memory of 1272	5088	cmd.exe	95
PID 5088 wrote to memory of 1272	5088	cmd.exe	95
PID 5088 wrote to memory of 1272	5088	cmd.exe	95
PID 3572 wrote to memory of 1712	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	102
PID 3572 wrote to memory of 1712	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	102
PID 3572 wrote to memory of 1712	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	102
PID 3572 wrote to memory of 3424	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	103
PID 3572 wrote to memory of 3424	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	103
PID 3572 wrote to memory of 3424	3572	eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe	103
PID 1712 wrote to memory of 4748	1712	coiome.exe	105
PID 1712 wrote to memory of 4748	1712	coiome.exe	105
PID 1712 wrote to memory of 4748	1712	coiome.exe	105
PID 4748 wrote to memory of 5108	4748	cmd.exe	107
PID 4748 wrote to memory of 5108	4748	cmd.exe	107
PID 4748 wrote to memory of 5108	4748	cmd.exe	107
PID 1712 wrote to memory of 2108	1712	coiome.exe	108
PID 1712 wrote to memory of 2108	1712	coiome.exe	108
PID 1712 wrote to memory of 2108	1712	coiome.exe	108
PID 2108 wrote to memory of 3528	2108	cmd.exe	110
PID 2108 wrote to memory of 3528	2108	cmd.exe	110
PID 2108 wrote to memory of 3528	2108	cmd.exe	110
PID 1712 wrote to memory of 684	1712	coiome.exe	111
PID 1712 wrote to memory of 684	1712	coiome.exe	111
PID 1712 wrote to memory of 684	1712	coiome.exe	111
PID 1712 wrote to memory of 1736	1712	coiome.exe	114
PID 1712 wrote to memory of 1736	1712	coiome.exe	114
PID 1712 wrote to memory of 1736	1712	coiome.exe	114
PID 1712 wrote to memory of 4408	1712	coiome.exe	116
PID 1712 wrote to memory of 4408	1712	coiome.exe	116
PID 1712 wrote to memory of 4408	1712	coiome.exe	116

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5108	attrib.exe
3528	attrib.exe

C:\Users\Admin\AppData\Local\Temp\eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\VGR.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im cfmon.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im cfmon.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im conlme.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im conlme.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im coiome.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im coiome.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- C:\Program Files (x86)\Common Files\sessavx\coiome.exe
  "C:\Program Files (x86)\Common Files\sessavx\coiome.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Cookies\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Cookies\*.*"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Local Settings\Temp\Cookies\*.*"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Cookies\*.*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\eabbc08a8189ea8dde19c9506688f59d_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\sessavx\coiome.exe

Filesize
12.0MB

MD5
d5ba5eb7b7eca572dbcfcbbd7a514945

SHA1
bae4e8241af9c64b0fe8002970f8ce3c25d6d0b7

SHA256
5aabcb07393031b63a84a34106e0098d9c5042abb3cc774a2d94e862d710ff0b

SHA512
8e060d3f83738530657a11107b390662407a6e384c7ddc91fd6e5b27abfc747a8f905fc00f6d8f9f33a0c7c25a47e50af0d2639b336a93bbabbc841f6833d89e

Download Submit
C:\Program Files (x86)\VGR.hta

Filesize
802B

MD5
8e0f805db5152f19ff8ddf203d93c3c1

SHA1
61d56c813de36bf08061497d28e99ad4cf6de84b

SHA256
c1035fb0a6516503223377252502a3de41e6a7337dbc25b1b503d6d72eff6f8b

SHA512
6d374479d9b8b3c9d3b46fea918dd36832b5438896131bd9b9844e6b9dedc6156098769fefc8efc1e5efc10fb9a0081c8eb44502035609345e43c379cbb0198f

Download Submit
memory/1712-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3572-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3572-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3572-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3572-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads