Overview

overview

8

Static

static

3

0849e5ddcd...18.exe

windows7-x64

8

0849e5ddcd...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 01:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0849e5ddcdd4c3ab2d35e55d4c824edc_JaffaCakes118.exe

  • Size

    480KB

  • MD5

    0849e5ddcdd4c3ab2d35e55d4c824edc

  • SHA1

    7b12f01349ea7be1aae8285741befa3719778038

  • SHA256

    6ef13ddae106a2203e94dae126c05bc4e19ce2ab99243fae78157cc48c62b995

  • SHA512

    cab50953e46159391d5700d32455e00787fff851c3ab989629c188d0958d46187c7acfac7b6370b381bfa3ddcbae45e1e5e4c0f2bd889b55bad3f944490c88af

  • SSDEEP

    6144:9Nc4Jjvl/4vUzQ2+edERhTZN0lQBoJDxJsdupHe5YezOZTWKxQUjPLxE4SvZe:9dlswF+edERzilQ6Hmd6JuWPgvs

Score
8/10
adwarebootkitdiscoverypersistencestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 19 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 59 IoCs
  • Drops file in Windows directory 35 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0849e5ddcdd4c3ab2d35e55d4c824edc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0849e5ddcdd4c3ab2d35e55d4c824edc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\3c4b.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2704
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\b366.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2348
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\bb3c.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2140
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\4533.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2752
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\bb65.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2740
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\5d3c.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2816
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\6cf5.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2820
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\54k3.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2860
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\3bmd.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2876
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\d6xb.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2976
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\54h4.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2812
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\b6bd.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2768
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\66bd.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2736
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s "C:\Windows\system32\66bd.dll"
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2908
    • C:\Windows\SysWOW64\4f43.exe
      C:\Windows\system32\4f43.exe -i
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2700
    • C:\Windows\SysWOW64\4f43.exe
      C:\Windows\system32\4f43.exe -s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2896
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32 C:\Windows\system32\dcy5.dll, Always
      2⤵
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:2576
  • C:\Windows\SysWOW64\4f43.exe
    C:\Windows\SysWOW64\4f43.exe
    1⤵
    • Drops file in Drivers directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\enpa3ml\4.dll
    Filesize

    124KB

    MD5

    42a070042a0d378cdca371e4a9e34431

    SHA1

    6d18c8e84410b5f9b73f14b6583312e1c3ddaa95

    SHA256

    b993c251c80bf19ba7039383288548c6080fa4d7d08dc1a33c87eedacd1588cd

    SHA512

    f81ed25f23f3e6ad0087584a3caf4ff7cef175438509d1e43848e305ef1ad077b9928ebe74440f136241c92f7ed616582aefb2b236bf53a08d50bfc2884c5818

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\enpa3ml\b.dll
    Filesize

    64KB

    MD5

    402d203bf685bce04851d0d12bdc1ac0

    SHA1

    f833665398279d7532b66e055bbfc5abdc51f792

    SHA256

    cd78c2e3cec32fb95d329dad6bcb95fa97e90a0b6da47ab783964d93366c1e1c

    SHA512

    00d31ac8a0d8354d64fb26400eb0b686bcdb9f167c34dd2d04160bf8ec5f7f32f1367ef1d5fa3726e87cbaac84f19676d5ab8d4bb955d1eddbbe033878ed69b8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\enpa3ml\p.dll
    Filesize

    716KB

    MD5

    8bb32dae7358d42ca2b9027665ed5cdd

    SHA1

    6f194b170145f1aadd6e3991274b054c0d19513d

    SHA256

    5ef7dc667f61ab729f76cdfa373414e0aa5361987fcacfee524d2db2710fab05

    SHA512

    73ada84ab602965ece179f8c6a3130fa190a8f24969197b016f681b1e6484a2e2560eb33387327426b74d48dc01a420ff45d4e6d4b0c0ee979afbe37da2c4992

    Download Submit