Overview

overview

7

Static

static

3

f248b1a07d...18.exe

windows7-x64

7

f248b1a07d...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 00:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f248b1a07db8b97cf265448f8008e45c_JaffaCakes118.exe
  • Size 906KB
  • Sample240416-axxdbsed91
  • SHA256 35fd246518e98c54b1bed22cfde6d5450d8f9a24da7502dfcf351c8ce631c3a8
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarepersistencestealerupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 46 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f248b1a07db8b97cf265448f8008e45c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f248b1a07db8b97cf265448f8008e45c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:5236
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\kosp1279_84.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\kosp1279_84.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4092
      • C:\Windows\SysWOW64\bpk.exe
        C:\Windows\system32\bpk.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Installs/modifies Browser Helper Object
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3460

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        bpk.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpk.exe
        • Size 213KB
        • SHA256 dfe37aaf5eb5ec3c2c2406e797b050538a74245ce8d46f6f46a19bf5d5c0744e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bpkhk.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkhk.dll
        • Size 25KB
        • SHA256 0bf2528570b647ea6c9173e1c7fcad4aa17998c6c852701f7f7b0889044425bb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bpkwb.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkwb.dll
        • Size 40KB
        • SHA256 34c4ef10f5aaeabd394567d981175ff34cf49aee19c898533bc0da4a5abc6e6c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        inst.dat
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
        • Size 996B
        • SHA256 2abb713883cabbb2d029f041bf8ee2633b6ef48c1b50bc611b95136f6b16fe41
        • MD5 SHA1 SHA512
        Submit Download

        kosp1279_84.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kosp1279_84.exe
        • Size 607KB
        • SHA256 feff7f154a229bdcd7f4c9b6a5aa7846e56d3cc923ffb3cfb3381a507b732a58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pk.bin
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
        • Size 3KB
        • SHA256 b881154c220957f9d83170c6e73d3d9c9ccabc68ef9a413afad6b5aecec25a4d
        • MD5 SHA1 SHA512
        Submit Download

        rinst.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
        • Size 7KB
        • SHA256 a9e46629c82f3d3060122f38e8ef924405fabb52df02711a1030f03f51cb6c7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bpk.exe
        • Path C:\Windows\SysWOW64\bpk.exe
        • Size 213KB
        • SHA256 a258574c02cc86bb87fc6bd57c44b0f81d311c36b167346f6b67f22c5c614172
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bpkhk.dll
        • Path C:\Windows\SysWOW64\bpkhk.dll
        • Size 25KB
        • SHA256 fad65854941fd8e03f9a0f8f8b6a71b684325d1785dbfbcb81423fb1583bc139
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bpkwb.dll
        • Path C:\Windows\SysWOW64\bpkwb.dll
        • Size 40KB
        • SHA256 d5d71403baaea62060dcbf5e9bd6f5d27102040244d9ba8f576b02df695d0324
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pk.bin
        • Path C:\Windows\SysWOW64\pk.bin
        • Size 3KB
        • SHA256 1394d6154f5c925f0221f70e14a0587f9108a62c90dc51e25d08a407923eae58
        • MD5 SHA1 SHA512
        Submit Download

        memory/3460-39-0x0000000000400000-0x0000000000483000-memory.dmp
        Download

        memory/3460-55-0x0000000000400000-0x0000000000483000-memory.dmp
        Download

        memory/3928-40-0x0000000000400000-0x0000000000407000-memory.dmp
        Download

        memory/3928-21-0x0000000000400000-0x0000000000407000-memory.dmp
        Download

        memory/4092-31-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/4092-54-0x0000000000400000-0x0000000000423000-memory.dmp
        Download

        memory/5236-53-0x0000000000400000-0x000000000041C000-memory.dmp
        Download