Overview
overview
10Static
static
3797e48f7d2...18.exe
windows7-x64
10797e48f7d2...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
36st41kqx2f.html
windows7-x64
36st41kqx2f.html
windows10-2004-x64
3quickHealt...min.js
windows7-x64
3quickHealt...min.js
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 11:52
Static task
static1
Behavioral task
behavioral1
Sample
797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
6st41kqx2f.html
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
6st41kqx2f.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
quickHealthNewsBoxNoProtocol.min.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
quickHealthNewsBoxNoProtocol.min.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
uninst.exe
Resource
win10v2004-20241007-en
General
-
Target
797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe
-
Size
267KB
-
MD5
797e48f7d26567ae870198f285539b9f
-
SHA1
93eaf02abbe32778dee3aee94387212f350a4566
-
SHA256
66aa0c03391ee652cb25383055da60ae88ea9c882cc191112edc45e666c6520e
-
SHA512
df0108523bf960fbc8a951dfb4dcca4d0478c12ee4632da1531d2059c764e7fce217d40f47852d8f358d85a5464746f2d6f8f66fe986b1faacae030883c65c72
-
SSDEEP
6144:kUj/w/CbKsDbpka73DeqyO5lF2WHjy3p5o5NWMxa9o:kquCnfpkaDLyO5+32WMx9
Malware Config
Extracted
C:\Users\Admin\Desktop\_HELP_HELP_HELP_HLDC35.hta
http://p27dokhpz2n7nvgr.16fohp.top/7095-B1FB-4DB6-0091-CFDEhttp://p27dokhpz2n7nvgr.1bniyw.top/7095-B1FB-4DB6-0091-CFDEhttp://p27dokhpz2n7nvgr.1em2j4.top/7095-B1FB-4DB6-0091-CFDEhttp://p27dokhpz2n7nvgr.1chy1m.top/7095-B1FB-4DB6-0091-CFDEhttp://p27dokhpz2n7nvgr.1kja1j.top/7095-B1FB-4DB6-0091-CFDE
http://p27dokhpz2n7nvgr.onion/7095-B1FB-4DB6-0091-CFDE
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Blocklisted process makes network request 5 IoCs
flow pid Process 1156 1248 mshta.exe 1160 1248 mshta.exe 1162 1248 mshta.exe 1164 1248 mshta.exe 1166 1248 mshta.exe -
Contacts a large (583) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 976 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp25E8.bmp" 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2304 set thread context of 2972 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 29 -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\ 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\bitcoin 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\excel 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\office 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\word 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\onenote 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\word 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files\ 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\outlook 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\steam 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\thunderbird 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\office 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\powerpoint 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\the bat! 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\ 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1512 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2092 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1512 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe Token: 33 2616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2616 AUDIODG.EXE Token: 33 2616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2616 AUDIODG.EXE Token: SeDebugPrivilege 2092 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 632 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 632 DllHost.exe 632 DllHost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2972 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2972 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2972 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2972 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 29 PID 2304 wrote to memory of 2972 2304 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 29 PID 2972 wrote to memory of 1248 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 31 PID 2972 wrote to memory of 1248 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 31 PID 2972 wrote to memory of 1248 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 31 PID 2972 wrote to memory of 1248 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 31 PID 2972 wrote to memory of 976 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 37 PID 2972 wrote to memory of 976 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 37 PID 2972 wrote to memory of 976 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 37 PID 2972 wrote to memory of 976 2972 797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe 37 PID 976 wrote to memory of 2092 976 cmd.exe 39 PID 976 wrote to memory of 2092 976 cmd.exe 39 PID 976 wrote to memory of 2092 976 cmd.exe 39 PID 976 wrote to memory of 1512 976 cmd.exe 40 PID 976 wrote to memory of 1512 976 cmd.exe 40 PID 976 wrote to memory of 1512 976 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe"2⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_HELP_HELP_HELP_HLDC35.hta"3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1248
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\system32\taskkill.exetaskkill /f /im "797e48f7d26567ae870198f285539b9f_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1512
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:632
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:2052
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x55c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
74KB
MD5b2d66e5047776c579daa0dc237025f46
SHA11c11e84a79f6199163f9b5e97bbd5c428ad67f2b
SHA25691aeeca152fcb94a66b4931d5017b5e0ce7573ba69d84a73143a981313284905
SHA512fb9d94d51a4395de6b9959be6cea5eb18b33d5fe7243e457600dc0e1f60eff460ff89ec29fb4b704e9e33fb6534bb3947274b681d4df975afed6d746eeb979d1
-
Filesize
151KB
MD54e0994e1fe94ed5569945fe5dbeb2571
SHA1aa268b45242e89c56342696541102647e4e422b2
SHA2568dfd198ae76f52162a3c4968f498aa4a183a9b3cec2dfbc28d840982c1be63d0
SHA5128c209659d5c579f363217b178138e39f69d7870972a7c28d8039160d983cc91a349eb2526de2924db86188621c772451cb28accce1bb8d25e1bd4d50036340ba
-
Filesize
11KB
MD5a4dd044bcd94e9b3370ccf095b31f896
SHA117c78201323ab2095bc53184aa8267c9187d5173
SHA2562e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA51287335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a