Malware Analysis Report

2024-11-30 02:40

Sample ID 240407-vzjv8shg4x
Target e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118
SHA256 4547ada9000728f06d6834f6e5c38eb7018cb1f78f816c0d3d23ebc976d49211
Tags
persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4547ada9000728f06d6834f6e5c38eb7018cb1f78f816c0d3d23ebc976d49211

Threat Level: Shows suspicious behavior

The file e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence spyware stealer

Executes dropped EXE

Reads WinSCP keys stored on the system

Deletes itself

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

NTFS ADS

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 17:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 17:25

Reported

2024-04-07 17:28

Platform

win7-20240221-en

Max time kernel

152s

Max time network

126s

Command Line

"taskhost.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\{ACE0168D-9EB0-9C26-9491-8AD04197DE94} = "C:\\Users\\Admin\\AppData\\Roaming\\Wyow\\yhic.exe" C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1504 set thread context of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Privacy C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7A19142A-00000001.eml:OECustomProperty C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Mail\WinMail.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1504 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe
PID 1504 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe
PID 1504 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe
PID 1504 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe
PID 2548 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\taskhost.exe
PID 2548 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\taskhost.exe
PID 2548 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\taskhost.exe
PID 2548 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\taskhost.exe
PID 2548 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\taskhost.exe
PID 2548 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\Dwm.exe
PID 2548 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\Dwm.exe
PID 2548 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\Dwm.exe
PID 2548 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\Dwm.exe
PID 2548 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\Dwm.exe
PID 2548 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\Explorer.EXE
PID 2548 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe
PID 2548 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe
PID 2548 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe
PID 2548 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe
PID 2548 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1504 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2548 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe
PID 2548 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe C:\Windows\system32\DllHost.exe

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe

"C:\Users\Admin\AppData\Roaming\Wyow\yhic.exe"

C:\Program Files\Windows Mail\WinMail.exe

"C:\Program Files\Windows Mail\WinMail.exe" -Embedding

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp31bb2edd.bat"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

Network

Country Destination Domain Proto
US 8.8.8.8:53 crl.microsoft.com udp
BE 2.17.107.9:80 crl.microsoft.com tcp
US 8.8.8.8:53 senglab.info udp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp
DE 87.106.190.169:80 senglab.info tcp

Files

\Users\Admin\AppData\Roaming\Wyow\yhic.exe

MD5 3ee4da66388c83010a38259e6767fa34
SHA1 ce4ab9c6db28f9c9eba47e69d713447d8eff3382
SHA256 e629bbecde4016cb8133c0b3c5d9531ce39a89730b993d70f539b4ce9fd37d9e
SHA512 9854a6092272f8685c5fad67225dcd63c0ab7d7dbbd79221fd194fd48ee787dd43cb9fb9f8f7d178587a5387a14c3558a11cc52834ad3eed4c13a3531ddbf92a

memory/1092-10-0x0000000001E10000-0x0000000001E37000-memory.dmp

memory/1092-11-0x0000000001E10000-0x0000000001E37000-memory.dmp

memory/1092-12-0x0000000001E10000-0x0000000001E37000-memory.dmp

memory/1092-13-0x0000000001E10000-0x0000000001E37000-memory.dmp

memory/1092-14-0x0000000001E10000-0x0000000001E37000-memory.dmp

memory/1156-17-0x00000000001A0000-0x00000000001C7000-memory.dmp

memory/1156-18-0x00000000001A0000-0x00000000001C7000-memory.dmp

memory/1156-19-0x00000000001A0000-0x00000000001C7000-memory.dmp

memory/1156-20-0x00000000001A0000-0x00000000001C7000-memory.dmp

memory/1216-22-0x0000000002A20000-0x0000000002A47000-memory.dmp

memory/1216-23-0x0000000002A20000-0x0000000002A47000-memory.dmp

memory/1216-24-0x0000000002A20000-0x0000000002A47000-memory.dmp

memory/1216-25-0x0000000002A20000-0x0000000002A47000-memory.dmp

memory/1996-27-0x0000000001C80000-0x0000000001CA7000-memory.dmp

memory/1996-28-0x0000000001C80000-0x0000000001CA7000-memory.dmp

memory/1996-29-0x0000000001C80000-0x0000000001CA7000-memory.dmp

memory/1996-30-0x0000000001C80000-0x0000000001CA7000-memory.dmp

memory/1504-33-0x0000000000270000-0x0000000000297000-memory.dmp

memory/1504-34-0x0000000000270000-0x0000000000297000-memory.dmp

memory/1504-35-0x0000000000270000-0x0000000000297000-memory.dmp

memory/1504-36-0x0000000000270000-0x0000000000297000-memory.dmp

memory/1504-37-0x0000000000270000-0x0000000000297000-memory.dmp

memory/1504-39-0x0000000000270000-0x0000000000297000-memory.dmp

memory/1504-38-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-40-0x0000000077D80000-0x0000000077D81000-memory.dmp

memory/1504-42-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-44-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-46-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-48-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-50-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-52-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-54-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-56-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-58-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-60-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-63-0x0000000077D80000-0x0000000077D81000-memory.dmp

memory/1504-62-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-65-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-67-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-69-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-71-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-73-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-75-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/1504-131-0x00000000002E0000-0x00000000002E1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

MD5 b04ee5a249dc91c49919163ed7e25cd1
SHA1 6316379805f630aa2cf7e15d7c2f1e13832c8aa3
SHA256 457493f59c4a0f25eea68645bb2b37df0c867318308b612fcec36b6138658af5
SHA512 eb343ab5e8427c0bc8e429761861d108d9eadc8c8d5d8b609be21513121dd3757c70d0295ef52034cda2ab803783253ac17e60103393588bf4eba64927502d1e

C:\Users\Admin\AppData\Roaming\Kapae\kynue.esf

MD5 133000b3baaf990b0d8b70bbee69c863
SHA1 9eccd771c2f7a5b361af6f6dd1a9b0304f02f6bb
SHA256 8050fb3063b9fee0ae44306acb4050cd28a53ceadc54d44f971a7684e87c6c1b
SHA512 45ca1c6a97f2c12c017c1c672196ac7ce456699b342b73a331bf52a3cb7f3164694ca26e61004cc365b21755293e29cdee4ea439e7f45723e772b641f25d0ae4

memory/1504-216-0x0000000000270000-0x0000000000297000-memory.dmp

memory/2240-217-0x0000000000050000-0x0000000000077000-memory.dmp

memory/2240-228-0x0000000077D80000-0x0000000077D81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp31bb2edd.bat

MD5 19b26188ab1eb3df0eae654a8d1be1dc
SHA1 9a85c9706086058c648a66999f6080c2ff775a6b
SHA256 97096a8af4e36291de88107527f4e4b43a534196c57e78bc618dc5f3014b08ac
SHA512 c4d81e45f3a84ece2133abf45a9ceffd221e0c333262a791381c95ac6dddcf62e864839960d7ca29e2d842180639b67a5ce9423d4574e572b9b589b41d2aeba3

memory/2240-310-0x0000000000050000-0x0000000000077000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 17:25

Reported

2024-04-07 17:28

Platform

win10v2004-20240226-en

Max time kernel

92s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e576dac1188eb161d153d2ec0099b8ea_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A