Overview

overview

7

Static

static

3

1a7b95d799...18.exe

windows7-x64

7

1a7b95d799...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 07:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1a7b95d799bfc4252f650808872bcd31_JaffaCakes118.exe

  • Size

    991KB

  • MD5

    1a7b95d799bfc4252f650808872bcd31

  • SHA1

    27f428ad55d6dd7921ad8cab710ac6975bda7134

  • SHA256

    7b7d6486a2949310dee64ef4d0c51939251fca19213efc6b861231435046fd7a

  • SHA512

    4de6da802aa5e1899be0b2bf2ea973c73f90d547b16db3ca20e8cc08a8a27d32a669726e4e287ac2d7992f9af0f6d0da8e0f178212d40c54b47a18b85f7f299e

  • SSDEEP

    24576:UpniXLZcchleJIqycPVQr+5IG/WUgRvkWdbSsaPsa3kY2+mO8i:KiX9c0cyGQr+3IRvkQy13O+mOh

Score
7/10
adwarediscoverystealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a7b95d799bfc4252f650808872bcd31_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1a7b95d799bfc4252f650808872bcd31_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\is-T84RP.tmp\is-I9LRK.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-T84RP.tmp\is-I9LRK.tmp" /SL4 $70120 "C:\Users\Admin\AppData\Local\Temp\1a7b95d799bfc4252f650808872bcd31_JaffaCakes118.exe" 783304 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Users\Admin\AppData\Local\Temp\is-MHLA5.tmp\baiducb.exe
        "C:\Users\Admin\AppData\Local\Temp\is-MHLA5.tmp\baiducb.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BaiduBar.dll
    Filesize

    286KB

    MD5

    e4bc62a44704db1e93d4e839781d1920

    SHA1

    1e9dcd259beff683a81432bf2539b047700a2f9a

    SHA256

    e58dfa77619ef7d60c9f7ef40db74a81643ecf1886d1960be65578b18183b318

    SHA512

    3bbc9e0745406863c27e9cb98bdd403b192840d905a9bba9bb02e86581d16805292c197c8a79ae6ee2f22c1ddc50f763b6e4ae95d21a9055b94abeb17ccdef04

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.inf
    Filesize

    586B

    MD5

    c16ee16e5e62d584f951648a69624ee0

    SHA1

    8dc6ce55244f1af441103ccf5ab3ce82cf740bfd

    SHA256

    91d09fb03928ce0689b08377c745d8d49758f4d13d46c842dc073dd645f52359

    SHA512

    d3f2c8e18a2dbf6fb0deb4c6f8af68c11f2a3dcf50acb526117e805ac4c82c592642ba554b0fd5713a5e4a0dd0a3acf81eab3370389615634fda954c083a4b1b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
    Filesize

    90KB

    MD5

    d553b62a8136d41289513c6405efea2d

    SHA1

    db48c3fd3993ff20511e47ffad14bfbdb9f438eb

    SHA256

    ce7cfb626807084186b248bbf2ef776eac086da936146f7d44956c2fcfaec1f8

    SHA512

    4a3767e8ac1e684a9a6eaced921b9599e34d5a4e83f034c7fe42bd8fd707a2b86f51ad485933fed5015554c3f9c4cf4b1357832964cc170d8cba86092fc9d2e2

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-MHLA5.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-MHLA5.tmp\baiducb.exe
    Filesize

    222KB

    MD5

    68af74f9069626a3aec0cf038de102db

    SHA1

    64d1472f511d140794fb954a6444a58c0c0b9538

    SHA256

    2cd991b41ed34ef85bd30005fcced10ad19cb50a99d62ff48ca86044185e591c

    SHA512

    a5ec034ca8f84cdf7fdc5d31ee394a03339c0266a0339ac25b442b5c4e6beb88faf13bd9848eb9fb6fd6aef4ab3ac167e6576f20d5c8f9809f1dff247fd5dfb3

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-T84RP.tmp\is-I9LRK.tmp
    Filesize

    634KB

    MD5

    d291acbf9866b8846fe0629e690feb1a

    SHA1

    293314b11340d798d3c74e2416e2a43f267a25d6

    SHA256

    ab3e1fa210171e5ed2decc615c9328379ee3d29b55ee0e5d7ef6bece43f583eb

    SHA512

    320e68a67fdcf13dc25640cf68468abd9e0dc51b647f95277eebbd06c7c5ee298b1f68d4a01deb886979e42cbc3eddf16ac4db18884a96b1535598ba11ba36ed

    Download Submit
  • memory/1888-66-0x0000000000400000-0x00000000004CD000-memory.dmp
    Filesize

    820KB

    Download
  • memory/2208-0-0x0000000000400000-0x0000000000413000-memory.dmp
    Filesize

    76KB

    Download
  • memory/2208-2-0x0000000000401000-0x000000000040A000-memory.dmp
    Filesize

    36KB

    Download
  • memory/2208-65-0x0000000000400000-0x0000000000413000-memory.dmp
    Filesize

    76KB

    Download