Overview
overview
10Static
static
10JaffaCakes...6d.zip
windows7-x64
1JaffaCakes...6d.zip
windows10-2004-x64
108751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
10104.248.22...A.html
windows7-x64
3104.248.22...A.html
windows10-2004-x64
3104.248.22...d.html
windows7-x64
3104.248.22...d.html
windows10-2004-x64
3104.248.22...r.html
windows7-x64
3104.248.22...r.html
windows10-2004-x64
3104.248.22...g.html
windows7-x64
3104.248.22...g.html
windows10-2004-x64
3104.248.22...9.html
windows7-x64
3104.248.22...9.html
windows10-2004-x64
3104.248.22...ain.js
windows7-x64
3104.248.22...ain.js
windows10-2004-x64
311.html
windows7-x64
311.html
windows10-2004-x64
312.html
windows7-x64
912.html
windows10-2004-x64
34a30275f14...ab.dll
windows7-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows7-x64
1031.exe
windows10-2004-x64
10Analysis
-
max time kernel
89s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4abc4e174beea2d801bab1f52a202a1adcdc372443e25a2f1875b90f112ff56d.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4abc4e174beea2d801bab1f52a202a1adcdc372443e25a2f1875b90f112ff56d.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
0di3x.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
0di3x.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
104.248.221.3/systemerror-ie-edge/_data_image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMA/xhBQAA.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
104.248.221.3/systemerror-ie-edge/_data_image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMA/xhBQAA.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
104.248.221.3/systemerror-ie-edge/dsffddfdfdsawqwq22121sdsd.html
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
104.248.221.3/systemerror-ie-edge/dsffddfdfdsawqwq22121sdsd.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
104.248.221.3/systemerror-ie-edge/img/blur.html
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
104.248.221.3/systemerror-ie-edge/img/blur.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
104.248.221.3/systemerror-ie-edge/img/headshot-bg.html
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
104.248.221.3/systemerror-ie-edge/img/headshot-bg.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
104.248.221.3/systemerror-ie-edge/indexe2c9.html
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
104.248.221.3/systemerror-ie-edge/indexe2c9.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
104.248.221.3/systemerror-ie-edge/js/main.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
104.248.221.3/systemerror-ie-edge/js/main.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
11.html
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
11.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
12.html
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
12.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
2019-09-02_22-41-10.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
31.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
31.exe
Resource
win10v2004-20241007-en
General
-
Target
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
-
Size
144KB
-
MD5
9e9bb42a965b89a9dce86c8b36b24799
-
SHA1
e2d1161ac7fa3420648ba59f7a5315ed0acb04c2
-
SHA256
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d
-
SHA512
e5ba20e364c96260c821bc61eab51906e2075aa0d3755ef25aabfc8f6f9545452930be42d978d96e3a68e2b92120df4940b276c9872ebf36fa50913523c51ce8
-
SSDEEP
3072:ep1qwbk6Wbh/UR++pz1OBrNtZtHpspurmxwPtnneZY:epoP6WV/C116rNbtHpsYrmSP1neZY
Malware Config
Signatures
-
Zloader family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Byho = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Cyduec\\gaafcy.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 212 set thread context of 2880 212 regsvr32.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 2880 msiexec.exe Token: SeSecurityPrivilege 2880 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1064 wrote to memory of 212 1064 regsvr32.exe 82 PID 1064 wrote to memory of 212 1064 regsvr32.exe 82 PID 1064 wrote to memory of 212 1064 regsvr32.exe 82 PID 212 wrote to memory of 2880 212 regsvr32.exe 94 PID 212 wrote to memory of 2880 212 regsvr32.exe 94 PID 212 wrote to memory of 2880 212 regsvr32.exe 94 PID 212 wrote to memory of 2880 212 regsvr32.exe 94 PID 212 wrote to memory of 2880 212 regsvr32.exe 94
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-