Overview

overview

7

Static

static

1

436f3bb004...18.exe

windows7-x64

7

436f3bb004...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 17:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    436f3bb0048722325eabef22616fa426_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    436f3bb0048722325eabef22616fa426

  • SHA1

    49ce250b7f9cdf782bfb555300360af7daadbcb2

  • SHA256

    3f4d58f344edeee68b3a61cfa26caa8fca0633ad37905ab46b5feb876767c6f6

  • SHA512

    db84eceb68a2356b90f6a71a06712a85edc0351fcc0821ed5da40889f5eea1e2c40272d87de5e494186d4b8969134cadb657e5cc6aa68b0e25f326cbd5dc3089

  • SSDEEP

    24576:V3Fq84VCFjYXCPhyruXl2sI4ISDxfMstNk/kxzp1I0l8q/Cf4i:f4VSsX1rMX1MAkOzz5lTqf4i

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\436f3bb0048722325eabef22616fa426_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\436f3bb0048722325eabef22616fa426_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Users\Admin\AppData\Local\Temp\nsk9EE2.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsk9EE2.tmp\BI\BI.exe { "json_send_time" : "14/10/2024 19:49:43:652" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "553120" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130818.01" , "bundle_id" : "72450259-677d-46dc-ad29-dfc7b934c574" , "machine_user_id" : "{8D29E504-3713-4E79-B073-24DC9D515CF8}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "F72F5CC7-D75F-490A-9F65-0594B8BA508A" , "publisher_internal_id" : "27" , "publisher_id" : "Avi Goldfinger" , "publisher_account_id" : "A-324085" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:228
    • C:\Users\Admin\AppData\Local\Temp\nsk9EE2.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsk9EE2.tmp\BI\BI.exe { "user_ie_security_level" : "Medium-High" , "json_send_time" : "14/10/2024 19:50:32:574" , "internal_error_description" : "HttpPost result: try1- SendRequest Error; try2- SendRequest Error; try3- SendRequest Error" , "internal_error_number" : "3" , "is_parallel" : "0" , "mrs_id" : "" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "553120" , "general_status_code" : "2" , "duration_details" : " InitPluginsDir:0 initializeParams:93 load_BITool:0 send_BI_Init:32 load_DownloadACC:15 retrieveUISource:0 unpack_webappfolder:0 unpack_icon:16 RetrieveMainOfferKey:0 unpack_OpenCandyDll:31 unpack_BunndleDll:16 load_webapphost:0 unpack_ProxyInstaller:0 navigate_loadingUI:609 navigateAsync_constMainOffer:0 BuildUserProfile:0 retrieve cid:0 callService1:16156 callService1:16032 callService1:16031 " , "phase_duration" : "" , "error_details" : "Failed communicate with the DistributionEngineService. Inner Error: SendRequest Error. InternalRetryNum: 3" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.19041.0" , "user_default_browser_version" : "9.11.19041.0" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "0.0" , "user_operating_system" : "Windows 10 Enterprise" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130818.01" , "bundle_id" : "72450259-677d-46dc-ad29-dfc7b934c574" , "machine_user_id" : "{8D29E504-3713-4E79-B073-24DC9D515CF8}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "F72F5CC7-D75F-490A-9F65-0594B8BA508A" , "publisher_internal_id" : "27" , "publisher_id" : "Avi Goldfinger" , "publisher_account_id" : "A-324085" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsk9EE2.tmp\BI\BI.exe
    Filesize

    75KB

    MD5

    36e5f42d4d498266464c407b58689c67

    SHA1

    ca8eaa7b520ee881034b1c94b23d926d11f8aedf

    SHA256

    b30ea88494e43ae40f879bc5c1c09ab810866b0f982eaf83a681da70e77880a6

    SHA512

    f99361ec8beb0321388414eaaaec433bfda5a8cb91c9d488d9eb217132e69aeb99598e43fdc9423196f3cca4d8b776f150734c93950a9b8f09499232e83423e8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsk9EE2.tmp\System.dll
    Filesize

    17KB

    MD5

    a4f38d1c7a480f5da1bb8097b8b939db

    SHA1

    b3129c2a0e61881381463f5e0cbbffa573daa845

    SHA256

    e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436

    SHA512

    fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsk9EE2.tmp\webapphost.dll
    Filesize

    760KB

    MD5

    89368675c21460d0e874741a9c91b186

    SHA1

    d010211a4e3a54ff50a51f89fe09179f86bff0ab

    SHA256

    caf60757dc1d9de205282a9b5419a92a54fa4371c30f47c3fd9899d63cbaffb9

    SHA512

    e081a9c84690dd352cd649a31478b50584c48c54d55d60de0a6a1d893ef616453256a3aecca0d9f724c8ed855df1d8b09274ad0276bd84b386d65dd4a5b0e7da

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsu9FBC.tmp\inetc.dll
    Filesize

    29KB

    MD5

    dccdcb124064a1d9a5eb12232348b898

    SHA1

    f294fac154cb1c6c18fe054ac584f767594b93fb

    SHA256

    37adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e

    SHA512

    bd89bcd513bb7120db80e1115b4caceaa18c4ea863fe29b232002d447c3813133ff2849fcb2d4df45e3ff67e0e0d9d340d61060b9c74045b17efa5b1c1f5b05e

    Download Submit