Analysis
-
max time kernel
207s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 00:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe
-
Size
165KB
-
MD5
fa1a19977598c3f020882a4fa32e04b7
-
SHA1
c902504f5377c31324e28801a67be6957e41271a
-
SHA256
97139bbaf34d92df333d9f791d12b11a8a273151edcaecb9ab7ec75bb034552f
-
SHA512
e8601a99fd078ce1084384205ea301806bafe000196fbef9bb39dbf6bc7c64e7d18bb630c11f101ae6a9776bf59ba5c9c20b1db46627d78db6a2f01912e6b06a
-
SSDEEP
3072:S5wCoIilDFGqO9dRbhdM07CU2PpfFnjRsRfYriwa9lV7+Xeb:S2lVlEqsdPy07CU2hBORf2Za9lViXk
Malware Config
Extracted
Family
zloader
Botnet
vlenie2020
Campaign
obnova20
C2
https://dasifosafjasfhasf.com/gate.php
https://kasfajfsafhasfhaf.com/gate.php
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php
Attributes
-
build_id
1869505135
rc4.plain
Signatures
-
Zloader family
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ofhiucd = "C:\\Users\\Admin\\AppData\\Roaming\\Ohbyy\\ebfyid.exe" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exedescription pid Process procid_target PID 2300 set thread context of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exemsiexec.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
taskmgr.exepid Process 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 1348 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
AUDIODG.EXEmsiexec.exetaskmgr.exedescription pid Process Token: 33 2800 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2800 AUDIODG.EXE Token: 33 2800 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2800 AUDIODG.EXE Token: SeSecurityPrivilege 2740 msiexec.exe Token: SeSecurityPrivilege 2740 msiexec.exe Token: SeDebugPrivilege 1348 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe 1348 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exedescription pid Process procid_target PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33 PID 2300 wrote to memory of 2740 2300 fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa1a19977598c3f020882a4fa32e04b7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2028
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4581⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1348