vobfus | 1a72fcf0697f519234b1d5c95d35cb5b9fe39cc4e526dd315facf70209182c09

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
Size

204KB
MD5

d4477410dde155a3ca27e7ed34b5122b
SHA1

8e12b40690799406305a3bdcdacda7fe989b3e2b
SHA256

1a72fcf0697f519234b1d5c95d35cb5b9fe39cc4e526dd315facf70209182c09
SHA512

11acbef9111e22cee1928979d23bee727f3ceda7faa09f58a4f0bd846a42be6ebb5af64ad5bb041c6063ca1f4e6d78d3802aeae507ea9597cc1a57f8166fa8ae
SSDEEP

3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1

Score

10^/10

vobfus persistence worm

Malware Config

Signatures

Vobfus
A widespread worm which spreads via network drives and removable media.
worm vobfus

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

pid process

2100 d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

pid process

2100 d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

pid process

2100 d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
2100 d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

pid	process
2100	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

pid	process
2100	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

pid	process
2100	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
2100	d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4477410dde155a3ca27e7ed34b5122b_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AG58FPQON.exe
Filesize
204KB

MD5
bc16fd3d2f28acbf47a8c13b7f05e801

SHA1
e94a6b855d1868b13228f86f72fdafc096790369

SHA256
4ad831b8590bd5ec9cd07436293f73093aa37d61d71636950e11f90d476cff2c

SHA512
2b44620749f81c641a18ca4668161f133a8ef1589503653b0e1232984284bf752838099e1cce0891f776bdab5ddda82b91851c3750f325b24ff24e8d574af21e

Download Submit
memory/2100-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download