Analysis
- max time kernel
207s - max time network
212s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system - submitted
02/12/2024, 00:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
300 seconds
General
- Target fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe
- Size 165KB
- Sample241202-a7f44awkcl
- SHA256 97139bbaf34d92df333d9f791d12b11a8a273151edcaecb9ab7ec75bb034552f
- MD5 fa1a19977598c3f020882a4fa32e04b7
- SHA1 c902504f5377c31324e28801a67be6957e41271a
- SHA512 e8601a99fd078ce1084384205ea301806bafe000196fbef9bb39dbf6bc7c64e7d18bb630c11f101ae6a9776bf59ba5c9c20b1db46627d78db6a2f01912e6b06a
- SSDEEP 3072:S5wCoIilDFGqO9dRbhdM07CU2PpfFnjRsRfYriwa9lV7+Xeb:S2lVlEqsdPy07CU2hBORf2Za9lViXk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
zloader
Botnet
-
vlenie2020
Campaign
-
obnova20
C2
-
https://dasifosafjasfhasf.com/gate.php
-
https://kasfajfsafhasfhaf.com/gate.php
-
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
-
https://fdsjfjdsfjdsdsjajjs.com/gate.php
-
https://idisaudhasdhasdj.com/gate.php
-
https://dsjdjsjdsadhasdas.com/gate.php
-
https://dsdjfhdsufudhjas.com/gate.php
Attributes
-
build_id
1869505135
rc4.plain
Signatures
- Zloader family
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ofhiucd = "C:\\Users\\Admin\\AppData\\Roaming\\Ohbyy\\ebfyid.exe" msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2300 set thread context of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1348 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: 33 2800 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2800 AUDIODG.EXE Token: 33 2800 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2800 AUDIODG.EXE Token: SeSecurityPrivilege 2740 msiexec.exe Token: SeSecurityPrivilege 2740 msiexec.exe Token: SeDebugPrivilege 1348 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2028
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4581⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1348