Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 16:20

General

  • Target

    0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi

  • Size

    3.9MB

  • MD5

    0b8b4d1854add7dfc1a27b1e93fb002b

  • SHA1

    38cecb90eb2b89d81db27a988ff09ce20db26e8e

  • SHA256

    dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88

  • SHA512

    746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34

  • SSDEEP

    98304:nxnFFK+GEWJRgsnAWE05y4faRXsYA+tiQDnIjlBzpA7iQTWKKhgblL0n:JFFKZEWJtni7XpA+MSIjl5pQnTWth

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 20 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1964
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 24DF91AAA51E1C54DC27C0DB29033CB1
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2580
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5CD75624FC4F290F47B774F3C017EB00 M Global\MSI0000
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1784
    • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe
      "C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f76f1e0.rbs

    Filesize

    223KB

    MD5

    6c3a5c82d3df11a4db7bb78ca670fd67

    SHA1

    22b81dae226fb11fab4737b1736e254416388caa

    SHA256

    bfca48eb9fdd1b97cbd9e13b2701552eb9eb592036099c780e374447d662620c

    SHA512

    1c58c54c85b2b9f9cf23d3aab026b727f3500295cf002a0b1531731c9715dce556527f75ce73eef9315887420e1d26d9670f3cd6849c7ebf3734e21c17cb5b96

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe

    Filesize

    4.3MB

    MD5

    96b62cfb83cf0e9790a3ef939173ee31

    SHA1

    23ecaefa21524e9446ea16e1f532f8bf9c5a56f1

    SHA256

    6fe23163ea43ab8d9e84fed45b8590fe643d599c7f218ea05d505e3aeea86f23

    SHA512

    d018997c50702fe035bd3974180f274ffa34605bd19a3ce8fbabf96633794afe8f1ee4a2ee731a9ff3c73163e45ad26f8d7bac30b9ae55d1d47c8a333b657b6b

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\VCRUNTIME140.dll

    Filesize

    83KB

    MD5

    e008fbfdea1bf873f3d94d74c1cf7935

    SHA1

    2a2af5e9084e7b55cdd5d01df342b02c1917573c

    SHA256

    678f9d715220512a823ca45d7e8545a1288728d8d47243e072e17049441cdd2b

    SHA512

    145acb67ab06dc90e5c7ed89623a339f595998af683bf47d665ffa23b05f9b87016b3ae5777c2c45f53b91a757e510b0f5aa5a9b908d79df3d566b2307d9d3d0

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l1-2-0.dll

    Filesize

    17KB

    MD5

    79ee4a2fcbe24e9a65106de834ccda4a

    SHA1

    fd1ba674371af7116ea06ad42886185f98ba137b

    SHA256

    9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613

    SHA512

    6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l2-1-0.dll

    Filesize

    17KB

    MD5

    3f224766fe9b090333fdb43d5a22f9ea

    SHA1

    548d1bb707ae7a3dfccc0c2d99908561a305f57b

    SHA256

    ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357

    SHA512

    c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    20KB

    MD5

    23bd405a6cfd1e38c74c5150eec28d0a

    SHA1

    1d3be98e7dfe565e297e837a7085731ecd368c7b

    SHA256

    a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41

    SHA512

    c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    18KB

    MD5

    95c5b49af7f2c7d3cd0bc14b1e9efacb

    SHA1

    c400205c81140e60dffa8811c1906ce87c58971e

    SHA256

    ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1

    SHA512

    f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-synch-l1-2-0.dll

    Filesize

    18KB

    MD5

    6e704280d632c2f8f2cadefcae25ad85

    SHA1

    699c5a1c553d64d7ff3cf4fe57da72bb151caede

    SHA256

    758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893

    SHA512

    ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    18KB

    MD5

    c9a55de62e53d747c5a7fddedef874f9

    SHA1

    c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad

    SHA256

    b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b

    SHA512

    adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    21KB

    MD5

    9ddea3cc96e0fdd3443cc60d649931b3

    SHA1

    af3cb7036318a8427f20b8561079e279119dca0e

    SHA256

    b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5

    SHA512

    1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    18KB

    MD5

    1776a2b85378b27825cf5e5a3a132d9a

    SHA1

    626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df

    SHA256

    675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee

    SHA512

    541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    18KB

    MD5

    034379bcea45eb99db8cdfeacbc5e281

    SHA1

    bbf93d82e7e306e827efeb9612e8eab2b760e2b7

    SHA256

    8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65

    SHA512

    7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    28KB

    MD5

    8da414c3524a869e5679c0678d1640c1

    SHA1

    60cf28792c68e9894878c31b323e68feb4676865

    SHA256

    39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672

    SHA512

    6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    22KB

    MD5

    fb0ca6cbfff46be87ad729a1c4fde138

    SHA1

    2c302d1c535d5c40f31c3a75393118b40e1b2af9

    SHA256

    1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df

    SHA512

    99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    23KB

    MD5

    d5166ab3034f0e1aa679bfa1907e5844

    SHA1

    851dd640cb34177c43b5f47b218a686c09fa6b4c

    SHA256

    7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5

    SHA512

    8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    20KB

    MD5

    9b79fda359a269c63dcac69b2c81caa4

    SHA1

    a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb

    SHA256

    4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138

    SHA512

    e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    18KB

    MD5

    70e9104e743069b573ca12a3cd87ec33

    SHA1

    4290755b6a49212b2e969200e7a088d1713b84a2

    SHA256

    7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95

    SHA512

    e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

    Filesize

    959B

    MD5

    d5e98140c51869fc462c8975620faa78

    SHA1

    07e032e020b72c3f192f0628a2593a19a70f069e

    SHA256

    5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

    SHA512

    9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

    Filesize

    192B

    MD5

    bcd1d97c3bee5778bb4d33e0d87ff9e6

    SHA1

    db64b9801db7a8c142093470b46780638ecad4ce

    SHA256

    bb7d224ac4a9a0cc9a2629c4213d8596b24998481e6f81148ce369f45dd0093e

    SHA512

    85753a250a75259de745fa4ba3a086d2ffec55efaf4c6c3e1eca6dbbde5bd4182b45dbdd6807d4ff735cd51fd9a9a4cd0d567f68cb4f82e0414dff5791fc9a98

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a4d5306ee84326cba235291893d4975f

    SHA1

    91f6a6a2d720a23a85dcd262d8b111490a174f5c

    SHA256

    0a688e9c76a3890f302cc7035bbdf819078ef561ab3273b8ba070a29f54050a5

    SHA512

    6ae5a4e8de310502d65b42624c5d1993d56c8996df9aa66f386a9ca42fd6b06b5bc3d1d65f3f60f93179ca7164abdb1affffc7571fcf88c5befc61d38f6bb82b

  • C:\Users\Admin\AppData\Local\Temp\CabF0C7.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF0D9.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\Installer\MSIF583.tmp

    Filesize

    211KB

    MD5

    a3ae5d86ecf38db9427359ea37a5f646

    SHA1

    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

    SHA256

    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

    SHA512

    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

  • C:\Windows\Installer\f76f1de.msi

    Filesize

    3.9MB

    MD5

    0b8b4d1854add7dfc1a27b1e93fb002b

    SHA1

    38cecb90eb2b89d81db27a988ff09ce20db26e8e

    SHA256

    dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88

    SHA512

    746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34

  • \Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    18KB

    MD5

    39325e5f023eb564c87d30f7e06dff23

    SHA1

    03dd79a7fbe3de1a29359b94ba2d554776bdd3fe

    SHA256

    56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a

    SHA512

    087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085

  • \Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    19KB

    MD5

    228c6bbe1bce84315e4927392a3baee5

    SHA1

    ba274aa567ad1ec663a2f9284af2e3cb232698fb

    SHA256

    ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065

    SHA512

    37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab

  • \Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    23KB

    MD5

    ad99c2362f64cde7756b16f9a016a60f

    SHA1

    07c9a78ee658bfa81db61dab039cffc9145cc6cb

    SHA256

    73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa

    SHA512

    9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7