Overview
overview
10Static
static
323850843bd...18.exe
windows7-x64
1023850843bd...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-10-2024 18:34
Static task
static1
Behavioral task
behavioral1
Sample
23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
uninst.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
uninst.exe
Resource
win10v2004-20241007-en
General
-
Target
23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe
-
Size
263KB
-
MD5
23850843bdf2d04e40039d2c8bf0c67c
-
SHA1
7b5a6afeb1d58db1d7d8576bcb85b7965b4d90a3
-
SHA256
bb1d145bd7ac01fbbed79059cabd43c17fbb38b40a611c5ca4d4294327b46b4d
-
SHA512
3c870581678d57f386a75993e0bb18c61d3173c80e62f11cf0285ba0f6fef27803fb481e7dcfd825917bf15b49524f8836f2cb2bdb9980e93eac389af1f5f244
-
SSDEEP
6144:SGy4qM153SMzkNpfVghxRmLGvRTqa37IWYdH4/PKv9Ev9V4YpeKHRk5SYu:S6qOSYkNmxRvvkakWYG/PK4VGKk8/
Malware Config
Extracted
C:\Users\Admin\Desktop\_HELP_HELP_HELP_SCGRZ.hta
http://p27dokhpz2n7nvgr.16fohp.top/8124-E1B6-BF7A-0088-9647http://p27dokhpz2n7nvgr.1bniyw.top/8124-E1B6-BF7A-0088-9647http://p27dokhpz2n7nvgr.1em2j4.top/8124-E1B6-BF7A-0088-9647http://p27dokhpz2n7nvgr.1chy1m.top/8124-E1B6-BF7A-0088-9647http://p27dokhpz2n7nvgr.1kja1j.top/8124-E1B6-BF7A-0088-9647
http://p27dokhpz2n7nvgr.onion/8124-E1B6-BF7A-0088-9647
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
flow pid Process 1157 2152 mshta.exe 1160 2152 mshta.exe 1162 2152 mshta.exe 1164 2152 mshta.exe 1166 2152 mshta.exe -
Contacts a large (583) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 1256 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpEDF7.bmp" 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2136 set thread context of 2544 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 31 -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\word 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files\ 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\ 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\ 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2396 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 1544 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2396 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe Token: SeDebugPrivilege 1544 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2232 DllHost.exe 2232 DllHost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2544 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 31 PID 2136 wrote to memory of 2544 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 31 PID 2136 wrote to memory of 2544 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 31 PID 2136 wrote to memory of 2544 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 31 PID 2136 wrote to memory of 2544 2136 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 31 PID 2544 wrote to memory of 2152 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2152 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2152 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2152 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 33 PID 2544 wrote to memory of 1256 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 38 PID 2544 wrote to memory of 1256 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 38 PID 2544 wrote to memory of 1256 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 38 PID 2544 wrote to memory of 1256 2544 23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe 38 PID 1256 wrote to memory of 1544 1256 cmd.exe 40 PID 1256 wrote to memory of 1544 1256 cmd.exe 40 PID 1256 wrote to memory of 1544 1256 cmd.exe 40 PID 1256 wrote to memory of 2396 1256 cmd.exe 41 PID 1256 wrote to memory of 2396 1256 cmd.exe 41 PID 1256 wrote to memory of 2396 1256 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe"2⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_SCGRZ.hta"3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2152
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\taskkill.exetaskkill /f /im "23850843bdf2d04e40039d2c8bf0c67c_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2396
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2232
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:1312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
74KB
MD50e4d867054be41f200ca1ef7293f87a5
SHA1c07478820e6293a982e15ebc21d087161f6cefa7
SHA2566877dc7c8dbd03f27aa165965f4ac86d5aee5e6cf5e1aea198b4f65b312edafe
SHA5124a02a46ac5c34accdf37beac4b890e2902e71fcc9b4db8aef940fea9e9546de081e70f408a27877fc2d652dfa39952ac161969a2e0051ecf8bd801587cf5f53c
-
Filesize
150KB
MD5912e60cfda2a71225b8e150c8f41e97a
SHA115ea1e077d31ef32fd823a09c00d4e3181dde23f
SHA2567cacc4f50e0c6b7d400d978465a99c652211a8e527db0b6b69511048ea9e5185
SHA512c58b48215a91c4e13911926fd50398ef8bb1a92b4c70445289ef88df43f046bb066b3a6f62df181da85bff33f4e0e3ab3d207034e71d8480455bc68d791ea681
-
Filesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00