Overview
overview
3Static
static
3Password_3...rd.exe
windows7-x64
3Password_3...rd.exe
windows10-2004-x64
3Password_3...ss.exe
windows7-x64
3Password_3...ss.exe
windows10-2004-x64
3Password_3...NT.exe
windows7-x64
1Password_3...NT.exe
windows10-2004-x64
3Password_3...ss.chm
windows7-x64
1Password_3...ss.chm
windows10-2004-x64
1Password_3...��.url
windows7-x64
1Password_3...��.url
windows10-2004-x64
1Password_3...��.url
windows7-x64
1Password_3...��.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Password_33LC/Password.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Password_33LC/Password.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Password_33LC/ViewPass.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Password_33LC/ViewPass.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Password_33LC/aRingNT.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Password_33LC/aRingNT.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Password_33LC/viewpass.chm
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Password_33LC/viewpass.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Password_33LC/绿茶系统.url
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Password_33LC/绿茶系统.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Password_33LC/绿茶网址导航.url
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Password_33LC/绿茶网址导航.url
Resource
win10v2004-20241007-en
General
-
Target
4342b1a8b809fce44e959db9991e75de_JaffaCakes118
-
Size
547KB
-
MD5
4342b1a8b809fce44e959db9991e75de
-
SHA1
5369afe78bc0548ff33f770bfe7cfbe361c92184
-
SHA256
d2bd936b69fe162d1f9cf85936cf82f4f5220001b7241478c76ea5fccd67880d
-
SHA512
18214c02bc87aa6b0ce504d0dcfdbf5e38eb2dee5c1fd80fc89a985d5bf43c0b090b47f418b6d883ce9f4e06cb68548b60791f0ea58ff0b1f4fac2fec286a108
-
SSDEEP
12288:QboKZm+hCmrJunqMaZFaXN+j4V0ObsJ+6RF:QEKLhxC8FaXN+j4Vn0xRF
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Password_33LC/Password.exe unpack001/Password_33LC/ViewPass.exe unpack001/Password_33LC/aRingNT.exe
Files
-
4342b1a8b809fce44e959db9991e75de_JaffaCakes118.rar
-
Password_33LC/Password.exe.exe windows:4 windows x86 arch:x86
1490557e456cffdae9595a96821632a7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetEntryDialParamsA
RasGetEntryPropertiesA
RasEnumEntriesA
kernel32
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sleep
GetVersionExA
GetProcAddress
GetACP
GetProfileStringA
LoadLibraryA
FreeLibrary
GetEnvironmentVariableA
WideCharToMultiByte
CloseHandle
ReadFile
CreateFileA
ExitProcess
GetLocalTime
FindClose
FindNextFileA
FindFirstFileA
CopyFileA
CreateDirectoryA
GetCurrentProcess
MultiByteToWideChar
ExpandEnvironmentStringsA
GetFileAttributesA
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
lstrcatA
lstrcpyA
lstrcpynA
lstrcmpA
lstrlenA
WritePrivateProfileStringA
WinExec
GetCurrentThreadId
LoadResource
FindResourceA
LockResource
GlobalFree
GetModuleHandleA
HeapSize
HeapReAlloc
GetFileType
SetStdHandle
HeapAlloc
RaiseException
GetCommandLineA
GetStartupInfoA
GetSystemTime
GetTimeZoneInformation
HeapFree
TerminateProcess
RtlUnwind
GetTickCount
FileTimeToLocalFileTime
FileTimeToSystemTime
SetErrorMode
GetFileTime
GetFileSize
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
SizeofResource
GlobalFlags
MulDiv
SetLastError
GetPrivateProfileIntA
GetCurrentThread
GetModuleFileNameA
GetThreadLocale
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
DuplicateHandle
FormatMessageA
LocalFree
InterlockedDecrement
InterlockedIncrement
GetVersion
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LCMapStringA
user32
GetSysColorBrush
CharNextA
CopyAcceleratorTableA
SetRect
GetNextDlgGroupItem
RegisterClipboardFormatA
PostThreadMessageA
EndPaint
BeginPaint
GetWindowDC
MapDialogRect
SetWindowContextHelpId
TranslateMessage
ValidateRect
ShowOwnedPopups
PostQuitMessage
CharUpperA
LoadStringA
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
SetWindowTextA
IsDialogMessageA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
PeekMessageA
GetFocus
SetFocus
AdjustWindowRectEx
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
IsChild
WinHelpA
RegisterClassA
UnpackDDElParam
TrackPopupMenu
GetWindowTextLengthA
GetWindowTextA
GetKeyState
CreateWindowExA
GetClassLongA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetWindow
RegisterWindowMessageA
IntersectRect
GetWindowPlacement
EndDialog
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
SetWindowPos
CallWindowProcA
GetForegroundWindow
CallNextHookEx
IsWindowVisible
SetWindowLongA
UnhookWindowsHookEx
SetWindowsHookExA
GetMenuItemRect
IsMenu
GetMenuItemCount
SetRectEmpty
SetMenuItemInfoA
GetClassNameA
GetMenu
GetPropA
SetPropA
SendMessageA
LoadIconA
InvalidateRect
EnableWindow
wsprintfA
UnregisterClassA
HideCaret
ShowCaret
RemovePropA
SystemParametersInfoA
LoadBitmapA
GetMenuItemInfoA
EqualRect
MoveWindow
EnumChildWindows
DefWindowProcA
MessageBeep
LoadCursorA
IsWindow
GrayStringA
DrawTextA
TabbedTextOutA
ScreenToClient
GetCapture
SetCapture
PtInRect
GetMessageA
DispatchMessageA
ReuseDDElParam
SetMenu
GetDesktopWindow
LoadAcceleratorsA
RedrawWindow
DefMDIChildProcA
DrawMenuBar
TranslateAcceleratorA
TranslateMDISysAccel
DefFrameProcA
GetMenuItemID
BringWindowToTop
ReleaseCapture
GetDlgCtrlID
IsRectEmpty
LoadImageA
GetIconInfo
GetDC
CreateIconIndirect
ReleaseDC
FillRect
DrawStateA
CopyRect
FrameRect
InflateRect
ExcludeUpdateRgn
DefDlgProcA
IsWindowUnicode
ShowWindow
PostMessageA
ExitWindowsEx
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClassInfoA
SetForegroundWindow
FindWindowA
MessageBoxA
SetTimer
AppendMenuA
GetSystemMenu
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
GetCursorPos
GetSubMenu
LoadMenuA
SendMessageTimeoutA
KillTimer
IsCharAlphaNumericA
DestroyMenu
DestroyCursor
DestroyIcon
GetWindowLongA
GetNextDlgTabItem
GetParent
SetCursor
GetActiveWindow
WindowFromPoint
ClientToScreen
GetSysColor
OffsetRect
DrawFocusRect
GetWindowRect
TrackPopupMenuEx
gdi32
SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExcludeClipRect
IntersectClipRect
MoveToEx
LineTo
RestoreDC
GetViewportExtEx
GetWindowExtEx
GetMapMode
DPtoLP
GetBkColor
LPtoDP
SaveDC
PatBlt
Ellipse
GetTextMetricsA
GetDeviceCaps
DeleteDC
GetCharWidthA
CreatePatternBrush
GetTextExtentPoint32A
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
Rectangle
GetTextColor
GetCurrentObject
CreateFontIndirectA
CreateSolidBrush
CreatePen
GetClipBox
GetObjectA
GetPixel
SetPixel
CreateBitmap
SetBkColor
CreateCompatibleBitmap
SelectObject
GetStockObject
DeleteObject
BitBlt
CreateCompatibleDC
GetTextExtentPointA
CreateDIBitmap
SetTextColor
comdlg32
GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
LogonUserA
RegEnumKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
LookupAccountNameA
RegQueryValueA
RegEnumValueA
shell32
DragQueryFileA
DragFinish
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
comctl32
ord17
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Draw
ImageList_GetIcon
ImageList_Destroy
ImageList_Create
oledlg
ord8
ole32
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemAlloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoUninitialize
CoCreateInstance
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemFree
olepro32
ord253
oleaut32
SysAllocStringLen
VariantClear
VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysAllocString
SysAllocStringByteLen
SysStringLen
GetErrorInfo
SysFreeString
wininet
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetReadFile
Sections
.text Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Password_33LC/Password.ini
-
Password_33LC/ViewPass.exe.exe windows:4 windows x86 arch:x86
a1920ad1b14d1723c6ec510dc0482abe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
LoadLibraryA
GetVersionExA
WritePrivateProfileStringA
OpenProcess
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcpyA
MultiByteToWideChar
lstrlenA
InterlockedDecrement
InterlockedIncrement
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
SetUnhandledExceptionFilter
HeapSize
HeapReAlloc
WriteFile
VirtualFree
ReadProcessMemory
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LCMapStringW
LCMapStringA
HeapAlloc
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualAlloc
WaitForSingleObject
HeapFree
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
SetEnvironmentVariableA
GetCurrentThreadId
RaiseException
GetVersion
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
TerminateProcess
ExitProcess
GetLocalTime
GetSystemTime
VirtualFreeEx
GetExitCodeThread
HeapCreate
CloseHandle
GetLastError
WideCharToMultiByte
LocalFree
RtlUnwind
GetTimeZoneInformation
user32
RegisterWindowMessageA
SendMessageTimeoutA
MessageBoxA
EmptyClipboard
SetWindowLongA
ReleaseCapture
GetSystemMenu
AppendMenuA
DeleteMenu
LoadIconA
SendMessageA
LoadCursorA
GetDlgItem
CheckDlgButton
GetSystemMetrics
GetWindowRect
SetWindowPos
DialogBoxParamA
EndDialog
IsDlgButtonChecked
GetWindowTextA
OpenClipboard
GetDC
SetClipboardData
CloseClipboard
GetSysColor
ChildWindowFromPoint
SetCapture
SetCursor
GetCursorPos
WindowFromPoint
GetWindowThreadProcessId
GetClassNameA
ScreenToClient
GetParent
ChildWindowFromPointEx
GetWindow
PtInRect
GetWindowLongA
SetWindowTextA
FindWindowA
BringWindowToTop
ShowWindow
gdi32
CreateFontIndirectA
CreateSolidBrush
SetTextColor
SetBkColor
GetDeviceCaps
shell32
ShellExecuteA
ole32
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
oleaut32
GetErrorInfo
SysAllocStringByteLen
SysAllocString
VariantInit
VariantClear
SysStringLen
SysFreeString
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Password_33LC/aRingNT.exe.exe windows:4 windows x86 arch:x86
e1d56ecd11c6b73b99d4a0408f3cbd23
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetThreadPriority
GetCurrentThread
GetLastError
Sleep
MapViewOfFile
SetStdHandle
GetStringTypeW
VirtualUnlock
FormatMessageA
VirtualLock
LocalFree
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
FlushFileBuffers
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
CloseHandle
user32
FindWindowA
advapi32
SetEntriesInAclA
SetSecurityInfo
GetSecurityInfo
ntdll
strcmp
ZwClose
memset
_strupr
ZwOpenSection
RtlInitUnicodeString
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Password_33LC/viewpass.chm.chm
-
Password_33LC/绿茶系统.url.url
-
Password_33LC/绿茶网址导航.url.url