Overview
overview
7Static
static
3552ccebe1c...18.exe
windows7-x64
7552ccebe1c...18.exe
windows10-2004-x64
7$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$0/zwankysearch.dll
windows7-x64
1$0/zwankysearch.dll
windows10-2004-x64
1$0/zwankysearch.exe
windows7-x64
3$0/zwankysearch.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2024, 03:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$0/uninstall.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
$0/uninstall.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$0/zwankysearch.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
$0/zwankysearch.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
$0/zwankysearch.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$0/zwankysearch.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe
- Size 698KB
- Sample241018-dreswatfkb
- SHA256 621f646fc179862feb1a1a2557e3e10561c1b8dfe673d0bb0e1bc365331b3c80
- MD5 552ccebe1ceb972e667a506d15305095
- SHA1 c84cb86f31f0e69ed6f14b0bedee2ce33ceb252a
- SHA512 71a74651607d6682aa2b8b5f8b2ac24c6f45c23768ea8013e20223928012a6927ad19aad25e8ad0987d22eb27d1adb11d7aadc2af958455bfdfcd15326002c34
- SSDEEP 12288:pC3akvzGv2pxQcXlxPmJYWq1/pc2H3JZ1OeIaEIgTsbO/PVqUtQLld:pCfGojTgm1pZ/Ozwes6/PaLld
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 2628 zwankysearch.exe 4072 zwankysearch.exe 4464 zwankysearch1118.exe 2472 zwankysearch.exe - Loads dropped DLL 8 IoCs
pid Process 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 4072 zwankysearch.exe 4464 zwankysearch1118.exe 2472 zwankysearch.exe 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 zwankysearch1118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE zwankysearch1118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies zwankysearch1118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 zwankysearch1118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\HTE51PVR.htm zwankysearch1118.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\ZwankySearch\zwankysearch.dll zwankysearch.exe File opened for modification C:\Program Files (x86)\ZwankySearch\zwankysearch.dll zwankysearch.exe File created C:\Program Files (x86)\ZwankySearch\zwankysearch.exe zwankysearch.exe File created C:\Program Files (x86)\ZwankySearch\uninstall.exe 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zwankysearch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zwankysearch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zwankysearch1118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zwankysearch.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023ba2-119.dat nsis_installer_1 -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C9A36987-A614-48D9-A9CC-C0BF628D301C}\TopResultURLFallback = "http://www.zwankysearch.com/?tmp=redir_bho_bing&dist=0&prt=ZWANKYSEARCH1118&keywords={searchTerms}" zwankysearch.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\SearchScopes zwankysearch.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C9A36987-A614-48D9-A9CC-C0BF628D301C} zwankysearch.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C9A36987-A614-48D9-A9CC-C0BF628D301C}\DisplayName = "ZwankySearch" zwankysearch.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C9A36987-A614-48D9-A9CC-C0BF628D301C}\URL = "http://www.zwankysearch.com/?prt=ZWANKYSEARCH1118&keywords={searchTerms}" zwankysearch.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} zwankysearch.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\TopResultURLFallback = "http://www.zwankysearch.com/?tmp=redir_bho_bing&dist=0&prt=ZWANKYSEARCH1118&keywords={searchTerms}" zwankysearch.exe - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix zwankysearch1118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" zwankysearch1118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" zwankysearch1118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ zwankysearch1118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" zwankysearch1118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" zwankysearch1118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" zwankysearch1118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" zwankysearch1118.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe 4464 zwankysearch1118.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2472 zwankysearch.exe 2472 zwankysearch.exe 2472 zwankysearch.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4004 wrote to memory of 2628 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 87 PID 4004 wrote to memory of 2628 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 87 PID 4004 wrote to memory of 2628 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 87 PID 4004 wrote to memory of 4072 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 88 PID 4004 wrote to memory of 4072 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 88 PID 4004 wrote to memory of 4072 4004 552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe 88 PID 4464 wrote to memory of 2472 4464 zwankysearch1118.exe 90 PID 4464 wrote to memory of 2472 4464 zwankysearch1118.exe 90 PID 4464 wrote to memory of 2472 4464 zwankysearch1118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.exe"C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.exe" "C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.dll" 31884130032⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.exe"C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.exe" "C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.dll" ucehekiku " " mogameyed2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4072
-
-
C:\ProgramData\ZwankySearch\zwankysearch1118.exe"C:\ProgramData\ZwankySearch\zwankysearch1118.exe" "C:\Program Files (x86)\ZwankySearch\zwankysearch.dll" xuyukigura ratukozuri1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files (x86)\ZwankySearch\zwankysearch.exe"C:\Program Files (x86)\ZwankySearch\zwankysearch.exe" "C:\Program Files (x86)\ZwankySearch\zwankysearch.dll" huyohiret apasoyuqi2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsmB1AE.tmp\InstallOptions.dll
- Size 13KB
- SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
- MD5 d765c492c21689e3d9d61634371fd861
- SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
- SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
- SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsmB1AE.tmp\System.dll
- Size 10KB
- SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
- MD5 fe24766ba314f620d57d0cf7339103c0
- SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
- SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
- SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsmB1AE.tmp\ioSpecial.ini
- Size 758B
- SHA256 036dc18fa4ce304897edbacc5752ac673218deee3b33e8767250888b1e78f7a7
- MD5 525554ffa93e39b37ac74d81927e0f58
- SHA1 cbff95e5bca39d111001e3c490df6fba15a48860
- SHA512 bdd65a61327af65aee19d12fcea46dce8f6364ae906c24b4adc5978146dd049af60298eb767a05411d0a613dd5a77d46af5771c5924a633a3be18643d3ec9be5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsmB1AE.tmp\ioSpecial.ini
- Size 620B
- SHA256 98f09dfe7ab758ff114008be875e47d515e7d497172d65ac6c61904b67dda533
- MD5 668ed80a9411ed0acdea063b507bfec4
- SHA1 069a6d2f1bda0b48c584bdf6f7aeb1e82fbc0d21
- SHA512 7dc530a7e17d4603bd5d25b9408f469714b8ef861d2e291c1ddfbed29a43a5660e3970f20bd416fda556c82fc9fd00af86e7a1be33503f4ccc8a9bbb4877e86e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\uninstall.exe
- Size 78KB
- SHA256 8f75ba9703c28b460025e05615222ed2b31e5eed829bfbab30bb029e873c0c24
- MD5 490071c63a8583c44546421214809399
- SHA1 f2268f3629b25b73b7f3ad984d867be01c19a670
- SHA512 00301e21a10071a875b41ab8dbb715fad81af1c28f2badc8d2580b7b40ef52315fbd4af5e1e9a33c2070c3dc5c818632f0bed98f6e46d0869a3859997e12425b
- SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJGo5hcpw/1q792sX7Ia12/DY:8kjAJ4dDGkJ+AI0bo1qRka0/U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.dll
- Size 576KB
- SHA256 903a73225511a85add2bfc72f485f11d88c77bd57dca851921f195e93bdde16a
- MD5 0506a7773cfcf615042cc7ba3d5f311d
- SHA1 bd5042084ea6735a9479359fa5ce813e156765bd
- SHA512 0dbba9e23bda568e2bbdefb602ac7ed6b9cdacf199a2cb711c09032fbe05c12dbcbbe0028c495567c29a6e06a0b53f9d2482b8dba609550e9b994df31de64b1e
- SSDEEP 12288:FbPSqwuli2nPgfO89Ps9miztwEywPKg1yFg:9dwdoP789Omi5+wnn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nssE4E5.tmp\zwankysearch.exe
- Size 25KB
- SHA256 62d2098e86a466502beadb00537bcedc66a13b5c3363be2bde41c113f8188cb9
- MD5 f9ad165d8967009b916b4fdec3466528
- SHA1 48ce3da6ab0f3a053036c40da1082c00202957d0
- SHA512 f46a40748be0ad5f7b894d364e9364ab6877466fc74467dc1e674df1d0be5c9fc1404ea3de6b0dbd8eb40a50d9bdae32616ba00903afa35547964dbdcea834da
- SSDEEP 768:sNhPvQNTYI1XDa9D31jVLQcnvRBqkBalwq:sNhPvQSI1XDIDvLQcv3Slwq
- MD5 SHA1 SHA512 SSDEEP