Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
05-10-2024 05:44
General
-
Target
166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118.exe
-
Size
73KB
-
MD5
166480b160f6013cbc67e8c1dc7a937b
-
SHA1
6488c38bbf570691456f0639039138ca4fbd5b48
-
SHA256
9183b8178cc8412a505fdd0a3209afba89e67e388fef51c222f20f20d483029d
-
SHA512
58f5f61ca47c0374b58251e60a38d672aa17a748e7c8993e794bde89351e839be33a33b9ff4b8e268ab62c0cdae9e19df5655d4e1924573b8d1920262cd9916d
-
SSDEEP
1536:KCaIoX1oYOcbTMV88TXJLEu42EsCGu3SzRH:KCaZ2Yrb0VTXJYWEsCGuiN
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 13 IoCs
-
Loads dropped DLL 39 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 8 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\166480b160f6013cbc67e8c1dc7a937b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsoBAF7.tmp\MSNGamesSetup.exeC:\Users\Admin\AppData\Local\Temp\nsoBAF7.tmp\MSNGamesSetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsoE59F.tmp\InstGameInfoHelperMSN.exe"C:\Users\Admin\AppData\Local\Temp\nsoE59F.tmp\InstGameInfoHelperMSN.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\ehome\RegisterMCEApp.exe"C:\Windows\ehome\RegisterMCEApp.exe" /allusers "C:\Program Files (x86)\MSN Games\MSNGames-MCE.xml"3⤵
-
-
C:\Program Files (x86)\MSN Games\AdminWorker.exe"C:\Program Files (x86)\MSN Games\AdminWorker.exe" AddArcadeToFireWallExceptions3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\MSN Games\AdminWorker.exe"C:\Program Files (x86)\MSN Games\AdminWorker.exe" restoreShortcutsPathes3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\MSN Games\iWinTrusted.exe"C:\Program Files (x86)\MSN Games\iWinTrusted.exe" -install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\MSN Games\MSNGames.exe"C:\Program Files (x86)\MSN Games\MSNGames.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSN Games\iWinTrusted.exe"C:\Program Files (x86)\MSN Games\iWinTrusted.exe" -install4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\MSN Games\AdminWorker.exe"C:\Program Files (x86)\MSN Games\AdminWorker.exe" StartProcessNoWait "C:\Program Files (x86)\MSN Games\\iWinTrusted.exe" "-install"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSN Games\iWinTrusted.exe"C:\Program Files (x86)\MSN Games\iWinTrusted.exe" -install5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\MSN Games\AdminWorker.exe"C:\Program Files (x86)\MSN Games\AdminWorker.exe" StartProcessAndWait "C:\Users\Admin\AppData\Local\Temp\MSNGames\Downloads\iWinGames - Infinite Crosswords.exe" "/S" "6577137636012359169" "6577137643961526784" "" "" "price|999|gameSKU|6577137643961526784";PogoInstall;Infinite Crosswords4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MSNGames\Downloads\iWinGames - Infinite Crosswords.exe"C:\Users\Admin\AppData\Local\Temp\MSNGames\Downloads\iWinGames - Infinite Crosswords.exe" /S5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nso5A9F.tmp\iWinInstallOptions.exe"C:\Users\Admin\AppData\Local\Temp\nso5A9F.tmp\iWinInstallOptions.exe" /S6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Games\MSN\Infinite Crosswords\GLWorker.exe"C:\Games\MSN\Infinite Crosswords\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid65771376360123591694⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
617KB
MD56772fdec98b776314724f63be2f657b3
SHA16014eb84c278072a501790a9be7c061156c4b824
SHA2568265375aa8916022cddaf5921f034b787416af5be65526f0a15e5791ebd257ed
SHA5120bad9e075ff4df3606ae7efc3ad8e2038e0b7f69379b72bfbe2686ba6d92a7b3251b0cf021af9b9231b60b92d42a0af2f0e8a150e44b5410dab7e4b8b9a2273a
-
Filesize
1KB
MD5db3daf15dfd20f564e59e58d6ffae077
SHA171ed8b468bf72c45edecb5884216e47acacd8ffb
SHA2561d1a8db2b6d41d0c3692a5b058b92a4b08665b3577974c6ec824d1f38e030e52
SHA51271827b95d42d361aea51a40ec71e24bdd933ed97310cfc6dfd7e83c767e0a3c4f66ce19d55db56521e58d66c7b1ea817d3379c89d9fbc900574979c3feff9502
-
Filesize
47KB
MD53bef430235c592989ef45d64b8995fda
SHA10d99277cdeec4845540bcf456531b57e0e939cdd
SHA256624426067e03d13efcfc88d570cc593649b67bafd9bf673ab46046dab00d8d5d
SHA5127dd5904c5ff5680be017238bb3ed96f6652d575d2eb6d85d2a3ac8045c58d836ddca12d73ebab831f22a9b57a0e410c2a56359b5abf567be5ec565a9c781af96
-
Filesize
104B
MD59482e5ee38471e5b6a688ad0d02fe6b4
SHA112dfac1206e34a47b2d3f639106056c9f7ca3e7a
SHA256a655fa3c755d22a5a95b01a91030fe889e8c37e900226a05fc32aebd04fc4e2d
SHA512c8b1ec8ef2d48d3c8d57c2728bb1ae6d150f43bc3ccba063b819ae1e7809331b170fc764d655db5ee11c838cbb74b91abc3abd837d98830589ee5b3aa3e905a4
-
Filesize
74B
MD590b42fd8e93203218847a3c0a646d377
SHA10d485e2de867448e4853031d5714942128d92983
SHA256aec450600b1ea9c5cd12a92ff9764092434c2cca7e56c10c7b11a63a13209c5f
SHA512de8ab5192fbb9e1df4f1baa7436f2d21cbb94f921931d502aed87049b46affe2dba1929ef48b528f114722cff7c797d381070b35884f7bea18813df355b0ffab
-
Filesize
40KB
MD5bf7e93622206bd7206494a7b805c0954
SHA15dec728c393cafd17d55a18501770ce22f16ffae
SHA256cabc0465f851bce0342470e5f4d81a5f4045028d4093d059225b4f76eb6297d7
SHA512f60adc9f8086793070c9fe7b7f1aab75251a4c71622c364ff6fc0e63b5f14da3e56cbca412ce2d80322713d4e4ca6944ede640878f1d115a48b08a891305d9ce
-
Filesize
77KB
MD53ef7618619348fbbeca7b0f772be7e5c
SHA1d86829f29c8f22c2d3562269b3d2f0c3b822ad0c
SHA256d361e7b9d8d6e1e3c2b4977f53a06a363183b74796b27cbba2d0277a7e19a872
SHA512b7c339678b214ff57594f02f2953ec762584f8b31644b1f63ac55586423fd34a7afae9c3d208db7caaab6e30bcb806cc9720cdb34c58f466aabad547d3263376
-
Filesize
8KB
MD5d5c43fe0fd3f6b5c1d2d96ef21834f9d
SHA1f8e36c4fe187396cec014bb2e733d953b3a76fdd
SHA256ed0c4264b99666a9e59299097c2acc7549dcf7e896c2a7584d65a616aaa415e1
SHA512e629e4cab48e75c35dbbb33b427c31babe814ecadf4357695e7bb3370ca838005c9c156a3dcb79f574cfd4b05b4fa6b55c991f249d9f3b6b072c3d87468c04cc
-
Filesize
57KB
MD594ab5e493c7fd8358c9a893d0a108d5f
SHA15dd41e775bb246ee33cbbb6bbf1a4a6b65da1173
SHA25654e995d1600802e1dccb785ba3ea20d14c85b54e70c397d48074135f2c731b4a
SHA512f95197a3f28d57c77ad4f40346d941ce075e83bec79531eb7000b981f9587f0ccbe962edb11390c4a122386666e0665f1572091489338760a2dcd2bba0113164
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
10KB
MD556a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
-
Filesize
512B
MD5433030c5cbb375e16cc885014191f07b
SHA1485546229799b852d97fee65a5d899aaad757ed7
SHA2561095affbecd87e6bc9a6a2d3ba7937a2d847480b24b2cc66458b3614beb6bed4
SHA512c4506614047c741a2c8b039a878c7eeb387c9f136dd9be2847d1edee0848368517e18606110a5b1f225a2e937e7536420e9a68fd5bf7283e29efc41f40859091
-
Filesize
19B
MD5b95effb5cac0ebc1ea0c2e8e846e5045
SHA143eeed2f329347102b81baafc0cd9e62b5eae175
SHA2563d99b189ef5a1f1fd58289b094ea89759b812efadf4cc86598cc5c207ad51859
SHA51243c80d1713253a54b4d31a742c4afa5d0070a0f290498a71488d9d80156295438dd294496d21cb590f9ef95a1b99cf39073b026014b375d6b8d97e9b03674f2e
-
Filesize
4KB
MD549cd2c57170a77dfa6639da258bdcce1
SHA1fa49d2bbcccaa5219c96ecec6ef9833ebda3af2a
SHA2566dd1f4b52d063661e6da75d17880d8e0c0d5d5febff44824f646ac92faa7dc63
SHA512d5b2302f83f2cf7c7f45c38508ccf2ca7762f6ce2feb50b48a5337bdb1592cff3ecd43bfd06da4c9e29d420bc319a7d5ab9555598365137d67ea4875868de4a0
-
Filesize
1KB
MD5c2965cb96a332484fd16f6f43d367cce
SHA1ea86229b04037c6c333150235fc9f40d7675a3c6
SHA256ac368fbb7f15ee40eb4731284dc848a454f3a01cab11c9bfbcff8ae7c0782d72
SHA5124a499be02e4c45e00c75b8ab5b84f37c2311db6a78fcbbbc0ace6391a067aad731e23592cd4d014757e227f344575d9857c66a60a8c3dd4b6e8b11195255a147
-
Filesize
4.5MB
MD5d9491b48ad8ba2e01bb4c2227319c55c
SHA1f3fb231ee2c9c941a20911bb5c97db15938be785
SHA25632956cf2acbd4fea7663af2177c5323d0397b285e4096e150e8ae1ffb8f1d1d1
SHA5127ac18e7aefede8d0697273fba47d28089739bd3cdf1f1d27f2560a0dd2739e9cf12db8c787186ee33e23022a24ca4cbea5952bb361839287ac27f11a1e36ba47
-
Filesize
10.7MB
MD5a723f73cafced792d6b908c70368aa5e
SHA176725a966bb2f0151f9cbbd7ef41b4aa59255ca3
SHA25679b411d4ec2da73268cf304e5af339544cc516f1b9469a6722afcd72cc9aca1c
SHA51292f49b895638473084cf2c86b94ec414fc8c6ba5a1d0dba2cee999366f4f5983dff4ae986de12ad71591242aa511b732c80e28d58ee9151477e54419b8c92759
-
Filesize
218KB
MD5f117e941af67e0c73327b261d03d8293
SHA1c00aa7b9217793451b3cb5658a4f54a313ec2e36
SHA256cf76079b5d416815c3607b309336f5d6801a9953ad3d9d87eaebdffb531b08ea
SHA5121e5383d26544f082a0f7b20f828597c0a7004b7f71af285b40ec241fea739a96459b6899bd36ba5b216012ce87bc7b403797dc5c481aa947a63f26aeea571b1c
-
Filesize
5.6MB
MD5814bfe8f14c329e1442c3e3a8d8293b5
SHA1d453cdd5ca2819bda9c0a31bffaa9978503b6094
SHA25686ae8e00b375b9d576c8b2c859c3971cae7ff17c6133c79b1821fb76586041a4
SHA512a1516e11eac7f57cebbbf7fcca9f9a932f4d92841f655a7c63b56aca73903c3faa48ebb4cb357afde963abac84959277c080ae288da0833a303152e9246c47bf
-
Filesize
84KB
MD58003a3286495deed791c357cb8fc4e82
SHA1c3c602b0c69f1dc66c4f1e498c67e003f6f2d1e6
SHA256556f052e6bc898af76c81ce5d00493fd0c1364fdaf2c1567409154d10ffc2cc3
SHA51279fc49ed2fdbb4babe79937cb3c4a1db92a0ce0e948b083708d643b935cec57ea4feba3998e7530ea22aedc2eb71cfc061d259ba1d90234de968f0dfe66eecbd
-
Filesize
45.6MB
MD57b3ec6d1800cddc1b195d98244e98e5a
SHA14f1f7318c220cfca2d8631dc3398c3242bf34115
SHA2563cb4ae53e2756e00d016427ff3e27a488376e1ce81b5a2ce4e24520e7ca8000a
SHA512d8ff6fee981cd039499ea2b78d2565a5418a867a40eea43310051ff90a5f2a7462cd3c63c87f9e539135d91bcea0bf2dd5ceb25256201f781c8f49c344d0fb93
-
Filesize
11KB
MD5960a5c48e25cf2bca332e74e11d825c9
SHA1da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA256484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
SHA512cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
-
Filesize
14KB
MD5a5a4cee2eb89d2687c05ef74299f0dba
SHA1b9bff5987be422887f2f402357b47db2288a1a42
SHA256cb82268b778703db75961cddef33a695a674f0dfd28b7e710b198ef2d26d3963
SHA512f485267c6239f84d294ed4b0a82f317081e6e2e0c5613bd012bbd496b9ebccb8aca6944e80f84af51d17ac13f4d83480c34edfe37a3a9508ce0e67fc9f0b96f0
-
Filesize
94KB
MD54d3ac88054df63fc810427bdaa96c458
SHA1e4d554e03ba91f6b53a2a80253b339f56e303c94
SHA256b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6
SHA512d4732ad89bbb19b316dff1b9c534acf98bb985c89d1295f08e24b21531123426500b3712979dda2f0e941a5969c0cbca15bbd52f6c167653f96a494a6677ca54
-
Filesize
455KB
MD50025cd88501fa44e826bc9ed4bdef2fb
SHA1c1a5d54809ba50bea7c4cac90563eb50b1d973ab
SHA256f26ccc52aee7f6949d33a8c5eae4829bf94ad338765b04b68214cb5f375d5d59
SHA51296a78d4d84fa9aa74f7791d01534e9c18cabf31a73b2e6711d4152527e16265163f415b43f418112652f3642192a8409383098899f84cb762c4cf6ff2c8140fd
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
