Overview

overview

10

Static

static

3

b98322e43d...18.exe

windows7-x64

10

b98322e43d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 13:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b98322e43d25ba7b38c3417dda1e16a4_JaffaCakes118.exe
  • Size 97KB
  • Sample240404-qqa5hshf88
  • SHA256 9b5efb363cb8516b3515051b3299689e23e34f1b2444fc2234233148a2f30e51
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
    evasion
  • Adds policy Run key to start application 2 TTPs 18 IoCs
    persistence
  • Disables RegEdit via registry modification 8 IoCs
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b98322e43d25ba7b38c3417dda1e16a4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b98322e43d25ba7b38c3417dda1e16a4_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Adds policy Run key to start application
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\SysWOW64\s4827\smss.exe
      "C:\Windows\system32\s4827\smss.exe" ~Brontok~Log~
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\SysWOW64\s4827\winlogon.exe
        "C:\Windows\system32\s4827\winlogon.exe" ~Brontok~Is~The~Best~
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3832
        • C:\Windows\SysWOW64\s4827\services.exe
          "C:\Windows\system32\s4827\services.exe" ~Brontok~Serv~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3472
        • C:\Windows\SysWOW64\s4827\csrss.exe
          "C:\Windows\system32\s4827\csrss.exe" ~Brontok~SpreadMail~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:2488
        • C:\Windows\SysWOW64\s4827\lsass.exe
          "C:\Windows\system32\s4827\lsass.exe" ~Brontok~Network~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4900
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c net view /domain > "C:\Windows\system32\s4827\domlist.txt"
            5⤵
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:4036
            • C:\Windows\SysWOW64\net.exe
              net view /domain
              6⤵
              • Discovers systems in the same network
              PID:2960
        • C:\Windows\Ad10218\qm4623.exe
          "C:\Windows\Ad10218\qm4623.exe" ~Brontok~Back~Log~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3496
        • C:\Windows\SysWOW64\s4827\m4623.exe
          "C:\Windows\system32\s4827\m4623.exe" ~Brontok~Back~Log~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:2688
        • C:\Windows\SysWOW64\at.exe
          "C:\Windows\System32\at.exe" /delete /y
          4⤵
            PID:928
          • C:\Windows\SysWOW64\at.exe
            "C:\Windows\System32\at.exe" 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"
            4⤵
              PID:392
            • C:\Windows\SysWOW64\at.exe
              "C:\Windows\System32\at.exe" 11:03 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"
              4⤵
                PID:5064

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              qm4623.exe
              • Path C:\Windows\Ad10218\qm4623.exe
              • Size 97KB
              • SHA256 0bec29a05754b63ec110080bf220584759ffbf0aa73afb702babed788329d855
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              c_25122k.com
              • Path C:\Windows\SysWOW64\c_25122k.com
              • Size 97KB
              • SHA256 9b5efb363cb8516b3515051b3299689e23e34f1b2444fc2234233148a2f30e51
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              lsass.exe
              • Path C:\Windows\SysWOW64\s4827\lsass.exe
              • Size 97KB
              • SHA256 e53ba6b4b3653c15b1215d9861b8cbd23cb6abc9f1e2aa8d5439fb8686f1799d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              m4623.exe
              • Path C:\Windows\SysWOW64\s4827\m4623.exe
              • Size 97KB
              • SHA256 4ab2da8beaf54f5e68844d2450973b4f98a7110ad732a45e13c55aa18eb0c634
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              winlogon.exe
              • Path C:\Windows\SysWOW64\s4827\winlogon.exe
              • Size 97KB
              • SHA256 d69550dff7298724248f01164066b715ab8117346b43d78294d102039f41a1da
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/2688-164-0x0000000000400000-0x0000000000417000-memory.dmp
              Download

              memory/3496-149-0x0000000000400000-0x0000000000417000-memory.dmp
              Download

              memory/3832-72-0x0000000000400000-0x0000000000417000-memory.dmp
              Download

              memory/4476-45-0x0000000000400000-0x0000000000417000-memory.dmp
              Download

              memory/4900-145-0x0000000000400000-0x0000000000417000-memory.dmp
              Download

              memory/4920-0-0x0000000000400000-0x0000000000417000-memory.dmp
              Download