Analysis

  • max time kernel
    148s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 02:30

General

  • Target

    32432f63ce811f734d1938060fe83b4c_JaffaCakes118.vbs

  • Size

    1.9MB

  • MD5

    32432f63ce811f734d1938060fe83b4c

  • SHA1

    e768c6bf965a548f8e8e79413d67998ee5173364

  • SHA256

    798e44b2af6329ac38f144d816096b72889009f44c9d74aefa36c11dbdc5522a

  • SHA512

    d41328ae22eb0768c70567c7759ed9164112c47f4c81ffb3c3b387c0f8fe33b29725d25cd5b8b390c9feca405d9f426cb823ed8ec5b91d7a139ae5de742e9351

  • SSDEEP

    49152:bs87tFIYKrGSBUsthSxelQwz1w9r+U32mIXzTmCc4iMVWS:k

Malware Config

Extracted

Family

qakbot

Version

323.79

Botnet

spx04

Campaign

1568039940

C2

190.120.196.18:443

70.169.2.228:21

189.160.191.239:443

174.48.72.160:443

99.231.208.9:443

12.5.37.3:443

173.178.129.3:443

189.236.138.168:443

67.41.197.173:2078

173.172.205.216:443

76.69.181.244:995

70.164.39.91:443

75.131.72.82:443

189.236.214.160:995

199.126.92.231:995

98.224.57.108:443

72.142.106.198:995

98.186.90.192:995

72.36.14.160:443

75.177.172.209:6882

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32432f63ce811f734d1938060fe83b4c_JaffaCakes118.vbs"
    1⤵
      PID:1488
    • C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
      C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
        C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /C
        2⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        PID:2696
      • C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe /C
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          PID:2752
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          3⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          PID:2288
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn szxlxrum /tr "\"C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe\" /I szxlxrum" /SC ONCE /Z /ST 02:32 /ET 02:44
        2⤵
        • Creates scheduled task(s)
        PID:2164
    • C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
      C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /I szxlxrum
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
        2⤵
          PID:1668
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
          2⤵
            PID:3680
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
            2⤵
              PID:3700
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
              2⤵
                PID:4436
              • C:\Windows\system32\reg.exe
                C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
                2⤵
                  PID:1240
                • C:\Windows\system32\reg.exe
                  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
                  2⤵
                    PID:760
                  • C:\Windows\system32\reg.exe
                    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
                    2⤵
                      PID:3100
                    • C:\Windows\system32\reg.exe
                      C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
                      2⤵
                        PID:2060
                      • C:\Windows\system32\reg.exe
                        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag" /d "0"
                        2⤵
                        • Windows security bypass
                        PID:4104
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2036
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe /C
                          3⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3004
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3120
                        • C:\Windows\system32\PING.EXE
                          ping.exe -n 6 127.0.0.1
                          3⤵
                          • Runs ping.exe
                          PID:436
                      • C:\Windows\system32\schtasks.exe
                        "C:\Windows\system32\schtasks.exe" /DELETE /F /TN szxlxrum
                        2⤵
                          PID:3788

                      Network

                      MITRE ATT&CK Matrix ATT&CK v13

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Defense Evasion

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      3
                      T1112

                      Discovery

                      System Information Discovery

                      2
                      T1082

                      Query Registry

                      2
                      T1012

                      Peripheral Device Discovery

                      1
                      T1120

                      Remote System Discovery

                      1
                      T1018

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
                        Filesize

                        660KB

                        MD5

                        048a451e99556b0f90576c2a976073d7

                        SHA1

                        1d3bc3472ec2313038f120020e3ce54db3db72f3

                        SHA256

                        f5d56d68b93516d18564a7862f2494e99827a0bd9071476e0585a2a345e7879a

                        SHA512

                        eb2aff455619c4dda5ed02f1b46a36a065d26671b55a8c94c8d47cd50419288b3937ebc014c9a5fc3dc3bc8a7223e5bfa54b963575cda0606b2f611e4ad9f3d4

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.dat
                        Filesize

                        63B

                        MD5

                        2d46a1fbebe23b6c53f2d9819148b0d8

                        SHA1

                        6e9366026fc9158d3cccea519c44a6f64dd9edeb

                        SHA256

                        12df80c5b68fc5dc5a908a490a39b6a1f9a5191fd518dd12980c743612450376

                        SHA512

                        62992b63c7e501513b6339399f016fd4de82698cc74413e54c6bd2280029e276e5fc12b83c778b3179bed04eddb66fdd23b2c95f0d9528e4b4ee6f1bde56be8c

                      • memory/2036-56-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2288-39-0x0000000002F70000-0x0000000002FB0000-memory.dmp
                        Filesize

                        256KB

                      • memory/2288-34-0x0000000000F10000-0x0000000000FA1000-memory.dmp
                        Filesize

                        580KB

                      • memory/2288-36-0x0000000002F70000-0x0000000002FB0000-memory.dmp
                        Filesize

                        256KB

                      • memory/2288-37-0x0000000002F70000-0x0000000002FB0000-memory.dmp
                        Filesize

                        256KB

                      • memory/2288-33-0x0000000002F70000-0x0000000002FB0000-memory.dmp
                        Filesize

                        256KB

                      • memory/2288-30-0x0000000000F10000-0x0000000000FA1000-memory.dmp
                        Filesize

                        580KB

                      • memory/2288-32-0x0000000000F10000-0x0000000000FA1000-memory.dmp
                        Filesize

                        580KB

                      • memory/2324-43-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2324-50-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2640-35-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2640-23-0x00000000021D0000-0x0000000002261000-memory.dmp
                        Filesize

                        580KB

                      • memory/2696-9-0x0000000002170000-0x0000000002201000-memory.dmp
                        Filesize

                        580KB

                      • memory/2696-13-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2752-29-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2832-24-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2832-5-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB

                      • memory/2832-4-0x0000000002260000-0x00000000022F1000-memory.dmp
                        Filesize

                        580KB

                      • memory/3004-55-0x0000000000400000-0x00000000004A7000-memory.dmp
                        Filesize

                        668KB