e30bc522aba78f8b77370ee26cb7af1ae850ba9b81a8b746ecb744ea1c57ef29

Analysis

max time kernel
146s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
Size

790KB
MD5

feef9b3b087ffda97e872d02dbb3b6c9
SHA1

76d74942ca320bf3fe3a9931c80a352b420a7660
SHA256

e30bc522aba78f8b77370ee26cb7af1ae850ba9b81a8b746ecb744ea1c57ef29
SHA512

df2cc87a8a04933ddffb36775d463ac7cb28f15153e782f06c7740f0175bdcd3bf6a94273a9f7fc611dc6105c6991d45e07e54d93d3a215352e22ba624d7abf4
SSDEEP

6144:ZiMmXRH6pXfSb0ceR/VFAHh1kgcs0HWHkyApOhP/SgljwRwdX/1H9kM2AfQ2C4e/:zMMpXKb0hNGh1kG0HWNAuCsltHw

Score

10^/10

aspackv2 persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b00000001332e-2.dat	aspack_v212_v242
behavioral1/files/0x0007000000015d56-38.dat	aspack_v212_v242
behavioral1/files/0x0001000000000026-55.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2468	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
2184	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
2184	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\G:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\X:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\N:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\L:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\O:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\R:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\B:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\J:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\T:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\W:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\Y:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\E:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\K:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\P:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\V:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\A:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\H:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\I:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\M:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\Q:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\S:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened (read-only)	\??\U:	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2468	2184	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2468	2184	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2468	2184	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2468	2184	feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\feef9b3b087ffda97e872d02dbb3b6c9_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.exe

Filesize
791KB

MD5
b3fe107f08de3474bb9832305ab9923a

SHA1
ecd92d51b06640f9b3b3c517e01518fc2caccb62

SHA256
7a9fc3788858a4e54caca318d7528c4aaaa8fcdfd09e235bf198d03e846756d9

SHA512
a2c70f80cc209e6c88d7e45cf0986f078f4feecaf9193c88567cc2cdba5824c2d56934a3ab0c08fd6772476af6fca323c847a6f50fa6d8450409d2a816fbb5ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
6d80b417c68ff351acee2c00ca0e3c50

SHA1
339d7f7b602a25ec584f0e6bc656a6e34424dc1c

SHA256
655610436184ae6964b7633e8630885b457c8a2527666306f7e99c5e80c7fd8c

SHA512
2e1bca85f863b21b5d305eb0abb0744d4c4860891b6e956d6c35a72a0b624d336ffc8b03e78d4080a896059af7ede3113735650bd0ccdab7581fa581ec1d629d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
97bfd048973bae5fd04df9e1120257ab

SHA1
a737877f0ec15709a215035df641df6d50d18c1b

SHA256
6e8195e7de547287f7ab94d0d57616016d1a5d09b0e20f6258d398917836c98d

SHA512
f980464c9b369bee78f127ca3d00e7b5cecfd95d68b189a1b6f3202543bba3fc056f9e08a1ee7ac7dd5dea27b781f0f35a84baa9ed4416d6dce6a92df1e1e2fd

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
790KB

MD5
feef9b3b087ffda97e872d02dbb3b6c9

SHA1
76d74942ca320bf3fe3a9931c80a352b420a7660

SHA256
e30bc522aba78f8b77370ee26cb7af1ae850ba9b81a8b746ecb744ea1c57ef29

SHA512
df2cc87a8a04933ddffb36775d463ac7cb28f15153e782f06c7740f0175bdcd3bf6a94273a9f7fc611dc6105c6991d45e07e54d93d3a215352e22ba624d7abf4

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
788KB

MD5
4cf73dd0e9f0f8b555a8f5c67aefd936

SHA1
f5e705770870db7b9a3355742b01b5ce37b6e5b0

SHA256
04c46f5fefacf2ef0fd642558f198a28417a63023ad4750856696d745999afb5

SHA512
bbbb94d7ae8829d09f039f0edc3213f1629f380f84faa38d210e86d4ee4c041615e21ca2b541fbe4d6cc6141745c39790557024a0804e28c34fb30e6bc72752b

Download Submit
memory/2184-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2468-10-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads