851d863ddd1dc3b62d1b3371c045a42c6690460968edd56c62a929f696e27c1d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Size

207KB
MD5

dbb5d0ae6717c01a48076d644189579c
SHA1

e5ae287805796da847eea1f1291557c4863c2732
SHA256

851d863ddd1dc3b62d1b3371c045a42c6690460968edd56c62a929f696e27c1d
SHA512

d101602c48d3259721950f2d479b81c17b8edff24d336692f4b8bc0f0a2cd73875c615699f493fede58b5bd9ba11816d6969b18cac78f7fcd06263ac4c1d6c92
SSDEEP

3072:81abGWGT2TK1dbzlF9OVtSZjCw8geIr/QAuCgNVfpxICuQsKUIZn:tbpGtfoVtScw2RCgrzItQB

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2556	ROV.EXE

Loads dropped DLL 2 IoCs

pid	Process
1728	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
1728	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-0-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/files/0x000b000000012256-13.dat	upx
behavioral1/memory/2556-21-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/1728-25-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2556-24-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RPDBI.EXE = "C:\\System Volume Information\\RPDBI.EXE"	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\E:	ROV.EXE
File opened (read-only)	\??\U:	ROV.EXE
File opened (read-only)	\??\H:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\M:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\O:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\E:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\J:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\G:	ROV.EXE
File opened (read-only)	\??\I:	ROV.EXE
File opened (read-only)	\??\P:	ROV.EXE
File opened (read-only)	\??\R:	ROV.EXE
File opened (read-only)	\??\T:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\V:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\H:	ROV.EXE
File opened (read-only)	\??\J:	ROV.EXE
File opened (read-only)	\??\S:	ROV.EXE
File opened (read-only)	\??\V:	ROV.EXE
File opened (read-only)	\??\N:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\S:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\U:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\T:	ROV.EXE
File opened (read-only)	\??\L:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\Q:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\L:	ROV.EXE
File opened (read-only)	\??\Q:	ROV.EXE
File opened (read-only)	\??\G:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\P:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\O:	ROV.EXE
File opened (read-only)	\??\M:	ROV.EXE
File opened (read-only)	\??\N:	ROV.EXE
File opened (read-only)	\??\I:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\R:	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
File opened (read-only)	\??\K:	ROV.EXE

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\JHYXF.EXE	ROV.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\VKZXXQS.EXE	ROV.EXE

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open	ROV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\System Volume Information\\RPDBI.EXE %1"	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\System Volume Information\\RPDBI.EXE \"%1\""	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\System Volume Information\\RPDBI.EXE \"%1\" %*"	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	ROV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\System Volume Information\\RPDBI.EXE %1"	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\System Volume Information\\RPDBI.EXE %1"	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	ROV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	ROV.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2556	1728	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2556	1728	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2556	1728	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2556	1728	dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbb5d0ae6717c01a48076d644189579c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728
- C:\$Recycle.Bin\ROV.EXE
  C:\$Recycle.Bin\ROV.EXE
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\filedebug

Filesize
330B

MD5
518217abd996d973076eaad2719445bd

SHA1
96e7693101a432e9113f587704842697a07b586b

SHA256
b3c09d6f4b14b43f9be5c216f187348ca99910f91574ca5dd0658da446425bbd

SHA512
19ab477dde6994fd5fa52ad83d317ab7fca039ea6cd62a6dce8a929f4bc91b87771f2aa1e4d1b0d7462089f6a95263709118fbe074bc5f2392e7062ceb36c566

Download Submit
\$Recycle.Bin\ROV.EXE

Filesize
207KB

MD5
221a9b4c32c0af8d6d38bd2eb778495d

SHA1
5e83318aa32d19eb2821d2f3fe54a46af3a8d818

SHA256
cbb00d91df21f1a65486ce1321b47f6e960c7fdf8152b41d6fb0d4ffe584279b

SHA512
d3a1c0ec025d10b6dcedb6c6e84c256a01b99da80cdf113034714eae709f938a5126c083b973522a55626302b83e209068df98339530c0caad4f0ae41e7f244d

Download Submit
memory/1728-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1728-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1728-19-0x0000000000510000-0x000000000057E000-memory.dmp

Filesize
440KB

Download
memory/1728-25-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2556-21-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2556-23-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2556-24-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads