Overview
overview
7Static
static
3029677a4a2...18.exe
windows7-x64
7029677a4a2...18.exe
windows10-2004-x64
7$0/resultbrowser.dll
windows7-x64
1$0/resultbrowser.dll
windows10-2004-x64
1$0/resultbrowser.exe
windows7-x64
1$0/resultbrowser.exe
windows10-2004-x64
3$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 17:55
Static task
static1
Behavioral task
behavioral1
Sample
029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$0/resultbrowser.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
$0/resultbrowser.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$0/resultbrowser.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$0/resultbrowser.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe
-
Size
652KB
-
MD5
029677a4a25f1f4d29223b989d2ac488
-
SHA1
40a0cf5525ec0714870774da57e3a7e434040f87
-
SHA256
b74202b42da26bced2ad73bc73b96faa8da54d1ea2049e4083f54b7b2a3348ca
-
SHA512
06451d4298ffd4e6a5a10c6310fd80c5af11c2430e0b7a0d251b5fb7da90baa32cf6d9b44cbe21574decc8badc2b9cd0fec2585bdcc7d2f3db80d83f695576f0
-
SSDEEP
12288:RfsJqbYp6TkQ3ykusestdhzgC7LP6BUQOVAJDSMEbQ5AFH/l:RE6Yp6TkQ3ykQwfz5LCGI1E4Ald
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2776 resultbrowser.exe 2684 resultbrowser.exe 2768 resultbrowser131.exe 3020 resultbrowser.exe -
Loads dropped DLL 9 IoCs
pid Process 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 2684 resultbrowser.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 3020 resultbrowser.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat resultbrowser131.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PXO4PH4M.htm resultbrowser131.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ResultBrowser\resultbrowser.dll resultbrowser.exe File created C:\Program Files (x86)\ResultBrowser\resultbrowser.exe resultbrowser.exe File created C:\Program Files (x86)\ResultBrowser\uninstall.exe 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe File created C:\Program Files (x86)\ResultBrowser\resultbrowser.dll resultbrowser.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language resultbrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language resultbrowser131.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language resultbrowser.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x0006000000019401-49.dat nsis_installer_1 -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{687FF929-9171-4A34-920E-236F73574715}\WpadDecision = "0" resultbrowser131.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-95-6d-94-bc-6f\WpadDecisionTime = 4036cc4c6213db01 resultbrowser131.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" resultbrowser131.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" resultbrowser131.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad resultbrowser131.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 resultbrowser131.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{687FF929-9171-4A34-920E-236F73574715}\WpadDecisionReason = "1" resultbrowser131.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" resultbrowser131.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" resultbrowser131.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{687FF929-9171-4A34-920E-236F73574715}\WpadDecisionTime = 4036cc4c6213db01 resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-95-6d-94-bc-6f resultbrowser131.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-95-6d-94-bc-6f\WpadDecision = "0" resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings resultbrowser131.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7a-95-6d-94-bc-6f\WpadDecisionReason = "1" resultbrowser131.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix resultbrowser131.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{687FF929-9171-4A34-920E-236F73574715}\7a-95-6d-94-bc-6f resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections resultbrowser131.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings resultbrowser131.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{687FF929-9171-4A34-920E-236F73574715} resultbrowser131.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{687FF929-9171-4A34-920E-236F73574715}\WpadNetworkName = "Network 3" resultbrowser131.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe 2768 resultbrowser131.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3020 resultbrowser.exe 3020 resultbrowser.exe 3020 resultbrowser.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2776 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2776 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2776 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2776 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2684 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2684 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2684 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2684 2112 029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe 31 PID 2768 wrote to memory of 3020 2768 resultbrowser131.exe 33 PID 2768 wrote to memory of 3020 2768 resultbrowser131.exe 33 PID 2768 wrote to memory of 3020 2768 resultbrowser131.exe 33 PID 2768 wrote to memory of 3020 2768 resultbrowser131.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\029677a4a25f1f4d29223b989d2ac488_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\nsjFA39.tmp\resultbrowser.exe"C:\Users\Admin\AppData\Local\Temp\nsjFA39.tmp\resultbrowser.exe" "C:\Users\Admin\AppData\Local\Temp\nsjFA39.tmp\resultbrowser.dll" 11200000832⤵
- Executes dropped EXE
PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\nsjFA39.tmp\resultbrowser.exe"C:\Users\Admin\AppData\Local\Temp\nsjFA39.tmp\resultbrowser.exe" "C:\Users\Admin\AppData\Local\Temp\nsjFA39.tmp\resultbrowser.dll" kadisuzude "" wajiwato2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2684
-
-
C:\ProgramData\ResultBrowser\resultbrowser131.exe"C:\ProgramData\ResultBrowser\resultbrowser131.exe" "C:\Program Files (x86)\ResultBrowser\resultbrowser.dll" cabawaji oxulalufir1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files (x86)\ResultBrowser\resultbrowser.exe"C:\Program Files (x86)\ResultBrowser\resultbrowser.exe" "C:\Program Files (x86)\ResultBrowser\resultbrowser.dll" unizemofoy juyudusah2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
560KB
MD56391c141e66f239b3795982dfa0248cb
SHA1000a405e16ced32045ef4bd0e49641ad29355a09
SHA256279af38f8e030b42b144acbf818ea0ac8e0c4fa8e040954312b60eb09b88a34f
SHA512c0a25af94a97645968fe7022cefed71b84110d4c7a8ab489162eee57b0cd2b5118aa2f4bbd101569643797ed79d793476953338409d50ac87889431db528bb8d
-
Filesize
83KB
MD5d90e0c54ddcc23cfc75e32579cc56c70
SHA183909c3ad775bac6210d4431b3f03e9229ca9877
SHA2568274bcdae8b130f8580abeab448d44eff756d0929a5ee3b88ff400db9bb8b806
SHA512548835b3e11e919d2092fef763b093df0cf879a0964eb0a65b98a753971ab708d65c1a48b7129a63a5c8bd15f40c846be01e0b5899bdbf9ebb977056ee797cfa
-
Filesize
44KB
MD53b6e1efd41843ab6a5237246494a2fa3
SHA16c1d8133cc9f5bd33264eea622bcc2c689c0c159
SHA256560c95d0c5550c1000d5b42c3a3062ad15a6caceaa9329e66c4f2dae92af9708
SHA5127c1d28640ed27d7edc7756872022f1fbff137a800755704281cc29655fc890da518c6f242894ba20d4d943bfe42a7cc719ec7de70d531fc434ce2def25d0bdb5