a17e76adefe08655eca8c581023081940aeb170343d8307470ba6de47e925d8c

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe
Size

525KB
MD5

fc5820cc6f4ee06de47249ec8ed3afc1
SHA1

e8eec4be470d99387a35794b0594b19c59ad73b0
SHA256

a17e76adefe08655eca8c581023081940aeb170343d8307470ba6de47e925d8c
SHA512

c7938c4204138d1e3095a8fb8d15f5ed2b525b049164f20bb5f4dced54da3c2eee8e2e051d64626164e5e9279590d481d4f5ae97f084cf9d52b26ccf619868dc
SSDEEP

6144:C7fy6Ezozt81ENRd3Qs1OUdK8N+VQs7PlWlBjPKXPXwboCTms51t1wZXzYEGgJrF:/bt1kRdAs1OYKPlWlBjifyPTmfWq

Score

8^/10

bootkit persistence spyware stealer upx

Malware Config

Signatures

Blocklisted process makes network request 9 IoCs

Processes:

rundll32.exe

flow	pid	process
2	2076	rundll32.exe
4	2076	rundll32.exe
6	2076	rundll32.exe
10	2076	rundll32.exe
11	2076	rundll32.exe
12	2076	rundll32.exe
13	2076	rundll32.exe
14	2076	rundll32.exe
15	2076	rundll32.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\??\c:\jabkiuo\vkhfp.kfv	acprotect

Deletes itself 1 IoCs

Processes:

wpkme.exe

pid process

2724 wpkme.exe
Executes dropped EXE 2 IoCs

Processes:

wpkme.exewiseman.exe

pid process

2724 wpkme.exe
2696 wiseman.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exerundll32.exe

pid process

2848 cmd.exe
2848 cmd.exe
2076 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2724	wpkme.exe

pid	process
2724	wpkme.exe
2696	wiseman.exe

pid	process
2848	cmd.exe
2848	cmd.exe
2076	rundll32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\wpkme.exe	upx
\??\c:\jabkiuo\vkhfp.kfv	upx
behavioral1/memory/2076-9-0x0000000010000000-0x000000001002A000-memory.dmp	upx
behavioral1/memory/2076-12-0x0000000010000000-0x000000001002A000-memory.dmp	upx
behavioral1/memory/2076-13-0x0000000010000000-0x000000001002A000-memory.dmp	upx
behavioral1/memory/2076-14-0x0000000010000000-0x000000001002A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exewiseman.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\jabkiuo\\vkhfp.kfv\",XML_MemFree"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wiseman = "C:\\wiseman.exe"	wiseman.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\z:	rundll32.exe
File opened (read-only)	\??\a:	rundll32.exe
File opened (read-only)	\??\e:	rundll32.exe
File opened (read-only)	\??\h:	rundll32.exe
File opened (read-only)	\??\q:	rundll32.exe
File opened (read-only)	\??\u:	rundll32.exe
File opened (read-only)	\??\x:	rundll32.exe
File opened (read-only)	\??\b:	rundll32.exe
File opened (read-only)	\??\g:	rundll32.exe
File opened (read-only)	\??\m:	rundll32.exe
File opened (read-only)	\??\r:	rundll32.exe
File opened (read-only)	\??\k:	rundll32.exe
File opened (read-only)	\??\o:	rundll32.exe
File opened (read-only)	\??\s:	rundll32.exe
File opened (read-only)	\??\t:	rundll32.exe
File opened (read-only)	\??\w:	rundll32.exe
File opened (read-only)	\??\y:	rundll32.exe
File opened (read-only)	\??\i:	rundll32.exe
File opened (read-only)	\??\j:	rundll32.exe
File opened (read-only)	\??\l:	rundll32.exe
File opened (read-only)	\??\n:	rundll32.exe
File opened (read-only)	\??\p:	rundll32.exe
File opened (read-only)	\??\v:	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2540 taskkill.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2940 PING.EXE

pid	process
2540	taskkill.exe

pid	process
2940	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe
2076	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rundll32.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 2076 rundll32.exe
Token: SeDebugPrivilege 2540 taskkill.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exewpkme.exewiseman.exe

pid process

2320 fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe
2724 wpkme.exe
2696 wiseman.exe
2696 wiseman.exe

description	pid	process
Token: SeDebugPrivilege	2076	rundll32.exe
Token: SeDebugPrivilege	2540	taskkill.exe

pid	process
2320	fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe
2724	wpkme.exe
2696	wiseman.exe
2696	wiseman.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.execmd.exewpkme.exerundll32.exe

description	pid	process	target process
PID 2320 wrote to memory of 2848	2320	fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2848	2320	fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2848	2320	fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2848	2320	fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe	cmd.exe
PID 2848 wrote to memory of 2940	2848	cmd.exe	PING.EXE
PID 2848 wrote to memory of 2940	2848	cmd.exe	PING.EXE
PID 2848 wrote to memory of 2940	2848	cmd.exe	PING.EXE
PID 2848 wrote to memory of 2940	2848	cmd.exe	PING.EXE
PID 2848 wrote to memory of 2724	2848	cmd.exe	wpkme.exe
PID 2848 wrote to memory of 2724	2848	cmd.exe	wpkme.exe
PID 2848 wrote to memory of 2724	2848	cmd.exe	wpkme.exe
PID 2848 wrote to memory of 2724	2848	cmd.exe	wpkme.exe
PID 2724 wrote to memory of 2076	2724	wpkme.exe	rundll32.exe
PID 2724 wrote to memory of 2076	2724	wpkme.exe	rundll32.exe
PID 2724 wrote to memory of 2076	2724	wpkme.exe	rundll32.exe
PID 2724 wrote to memory of 2076	2724	wpkme.exe	rundll32.exe
PID 2724 wrote to memory of 2076	2724	wpkme.exe	rundll32.exe
PID 2724 wrote to memory of 2076	2724	wpkme.exe	rundll32.exe
PID 2724 wrote to memory of 2076	2724	wpkme.exe	rundll32.exe
PID 2076 wrote to memory of 2540	2076	rundll32.exe	taskkill.exe
PID 2076 wrote to memory of 2540	2076	rundll32.exe	taskkill.exe
PID 2076 wrote to memory of 2540	2076	rundll32.exe	taskkill.exe
PID 2076 wrote to memory of 2540	2076	rundll32.exe	taskkill.exe
PID 2076 wrote to memory of 2696	2076	rundll32.exe	wiseman.exe
PID 2076 wrote to memory of 2696	2076	rundll32.exe	wiseman.exe
PID 2076 wrote to memory of 2696	2076	rundll32.exe	wiseman.exe
PID 2076 wrote to memory of 2696	2076	rundll32.exe	wiseman.exe

C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\wpkme.exe "C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 2
3⤵
- Runs ping.exe
PID:2940

C:\Users\Admin\AppData\Local\Temp\wpkme.exe
C:\Users\Admin\AppData\Local\Temp\\wpkme.exe "C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe"
3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724

\??\c:\windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.exe "c:\jabkiuo\vkhfp.kfv",XML_MemFree C:\Users\Admin\AppData\Local\Temp\wpkme.exe
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076

\??\c:\windows\SysWOW64\taskkill.exe
taskkill /f /im attrib.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\wiseman.exe
"C:\wiseman.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\wiseman.exe
Filesize
378KB

MD5
8f242369cf14f2b26ced131d7dd67144

SHA1
d4f2f0f3047300ff5f36af6119ad5e109258fcd0

SHA256
03505198d487e04a8ec82c627d34e4d9145f211140c4c8793b4461621e6bf6ce

SHA512
4516b3fa2f68e64baf166bc7731ba3bb0ca53d36d71ff8fa78b1f211d7c14fc4442af50bd637d0c3f11913583c9c66996101d6e8738592a053e82a78bbd771f5

Download Submit
\??\c:\jabkiuo\vkhfp.kfv
Filesize
62KB

MD5
fb1d904d905d0f177e0fe9d0ac8a44a5

SHA1
c3b5ce7e61697e8e604cde525770e002175f2f96

SHA256
49d6d364a910ad716fa3ad6229479b2af0f0451ed41e9adc7d8537801cd67c2a

SHA512
07bc9a2f0281fa6f99d5a0554190fa5671fc2c8bf1029f22745ddc73f33d7f57850104aec3d83c131f870b2f5197831a9e7f073f10596560c3117d2a37935647

Download Submit
\Users\Admin\AppData\Local\Temp\wpkme.exe
Filesize
526KB

MD5
23bc3278e7dc72daa99525435cef8043

SHA1
3460bd486c84c9bc9864e7e93354119076295f91

SHA256
6a66c01b9c2140ca57f72b0ade2161a0529d45910a0343dfe5491dda36fd7a85

SHA512
0987f416f578698829cd3feecba802da9296be92e362db0e7f38aaa1adbb397097e33b9620715d2eacfc1c31ea404ad2d1b555f2fa76820f37ff8800a150baaa

Download Submit
memory/2076-9-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2076-12-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2076-13-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2076-14-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download