a1ea81e2c6d6b5d29c178378321501415d77b4dc01e68877662ef2725f2ab948

Analysis

max time kernel
148s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe
Size

220KB
MD5

0a892a08a412adcc65702f61d285a442
SHA1

5525cac8ed52c537e67b95442d4d4f008b520db9
SHA256

a1ea81e2c6d6b5d29c178378321501415d77b4dc01e68877662ef2725f2ab948
SHA512

c1f67e7121775624c0c10c5b3f09d3f1bf3f23122fbe2ec7078a66a483064ecd84aeed46180405ddd5afd8c5da7601f901c91806c0af29b82e40786bca5e217f
SSDEEP

6144:xNSDyWIkFthprZ+orTh3HNdGu4uhUsBZUVteqm2:bSDyQFtjtZ5vBGbF

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
2472	tazebama.dl_

Loads dropped DLL 3 IoCs

pid	Process
2336	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe
2336	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe
2336	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE	tazebama.dl_

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tazebama.dl_

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2472	tazebama.dl_

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2472	2336	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2472	2336	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2472	2336	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2472	2336	0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a892a08a412adcc65702f61d285a442_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\tazebama.dl_

Filesize
151KB

MD5
a086d1808f21ec87ea03b8fee2fb416c

SHA1
79ef0fa8fad9c5905173a819807008a55f977cf3

SHA256
397536cfa872799592f557a29f7f766ce45ea9641e711ff84a315a0503f54707

SHA512
e231429ac84662b4115b076e1baaa8c43099a24586e27ac8905e1ae1e5c60f50cc834b3e92d167bf0f4d44cdea360556124f45acc8500179803f219f9d6b14e8

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
151KB

MD5
3cb0cda8b702462cf615a97d2de5ec06

SHA1
624c78f6f5f797df666357cebc99b844d9a04c39

SHA256
a7a0c1d5e8bc00091d42f676fd5322c8cf00aa8a85ce14446b5f6f12e5f3ec87

SHA512
338fb8888762ba2748cbfa6eadc2ce378457b0e9977fe8180658047770f75e799baac6ab47467faa2a2328b9717c7beeaeffc4abd3f759d02c1f6e6387262537

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\RCXB34A.tmp

Filesize
69KB

MD5
8ba404e90194c38541e324657e72f74c

SHA1
ad9fda28f95b7747579a7fbb8a18e1d1e6311a49

SHA256
8145e4c62390f9c55343cc6dadb790dc2cb9463c4f578fa57bf43f12c4720340

SHA512
1f594ebb6b970c9cb86b97d642351106a52db407c6e90db7391b50e97a1136e5ba13aeec66c9b985192c377d8c5c70d3746a00f37bcc83855fea316cf8d82362

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\S-1-5-21-4177215427-74451935-3209572229-1000 .exe

Filesize
151KB

MD5
91a8bce779c8408d10955bfb8950b496

SHA1
f0ea5f0452ef811eee609fb8d49f19080c87571b

SHA256
92b20a051d9e95de7c2aaf1a5d78cdd914c8d1ea5e73a124c6b267b8d313ea08

SHA512
f345ae6d5c43a3efc9a8218d8fdfac398c4d7ad4210bb0ce3e8a65a5722106e404dfaabf8024db9bc5c5e8ada78504d2eed40828beba2857dbc1a23dfbdaeacc

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\WinrRarSerialInstall.exe

Filesize
71KB

MD5
7446844a4a16e81c2a50c033f9a29c28

SHA1
9ff1fa63155cfd8d235b39fa56a858bb4c583b82

SHA256
375dd1e4b3829eb6dd6b9a5e734b961c530c8a746dfc5bbe8bdde5560dc435c1

SHA512
bd4d17604ef7027c43c5b9778426746616c9b6bbd9a8f7dea676c425ebb908c54b2ff3b75a9b6078deb118a6bb7f66e5c2dc705f39b12fe098bfa68e65fcc854

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\WinrRarSerialInstall.exe

Filesize
151KB

MD5
f529b0f248564d09e25e4b5e9512a1e6

SHA1
efa8a91c9d7a994cea1a80cd3a96dc02a16736c9

SHA256
c469346a0134de75110559132779768473662e46df00918737270f57234c5e8a

SHA512
b56409adf4e61add1293d20a815429fe36e3838ce17cae1fa34bb47a2565c582c3d50a9a6d18fad04b4e3b716bb03dec1e34ed8bfbba58f8cf2d2970b1ae3d58

Download Submit
F:\zPharaoh.exe

Filesize
151KB

MD5
28c62bb4faa1a43838bd50dfd5abb7a0

SHA1
4f557bc8e79331132c7ff5a19cc5f050a1e2fb7c

SHA256
0066f8c720f7e078066fb87ba4778d27e990e030dcb5e25d625b6fd373d271ab

SHA512
9c653e8ab82fde939dc5f50865d26239b7a0734a6e2cc14efcbd12f968907c0c857e8c53a8027f60514f5731d90209de7fa68079b2f7c5aefa65b077e7d85593

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/2336-15-0x0000000001006000-0x0000000001012000-memory.dmp

Filesize
48KB

Download
memory/2336-13-0x0000000000210000-0x0000000000226000-memory.dmp

Filesize
88KB

Download
memory/2336-14-0x0000000000210000-0x0000000000226000-memory.dmp

Filesize
88KB

Download
memory/2336-0-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download
memory/2336-6-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download
memory/2336-117-0x0000000001006000-0x0000000001012000-memory.dmp

Filesize
48KB

Download
memory/2336-514-0x0000000001000000-0x0000000001014000-memory.dmp

Filesize
80KB

Download
memory/2336-515-0x0000000000210000-0x0000000000226000-memory.dmp

Filesize
88KB

Download
memory/2336-516-0x0000000000210000-0x0000000000226000-memory.dmp

Filesize
88KB

Download
memory/2472-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2472-517-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download