Analysis

  • max time kernel
    92s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 18:19

General

  • Target

    4277477edd95a0337f04acb5f75705d1_JaffaCakes118.exe

  • Size

    21.3MB

  • MD5

    4277477edd95a0337f04acb5f75705d1

  • SHA1

    58ce92f0b43d1a67cf9a8e453a1c9c3978f203a8

  • SHA256

    af4076b2ca7ef8b6aa19702b2f31ad5dceb9feef26c4ec5b649afa83748bbbf8

  • SHA512

    88e7b67210f487743fb722d961d61760691b0ac1fb692cf0889b2939d8d360e39a3df2ff85108cd32242b3bfcf770f86b466729a5bc2829250d6d1e7e3eb1b7e

  • SSDEEP

    393216:w6Tm05yl21jcsqsPC3JUrnQxNboS59A43Uk4U6bOIkvzMe6:w6ijqjWunSNH59z4NOI+zMe6

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • NSIS installer 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4277477edd95a0337f04acb5f75705d1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4277477edd95a0337f04acb5f75705d1_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ZX Comany\Setup\11.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Program Files (x86)\ZX Comany\Setup\rar.exe
        rar.exe -p123321 -dC:\TEMP
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\TEMP\44.exe
          "C:\TEMP\44.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Users\Admin\AppData\Local\Temp\dfrgui.exe
            "C:\Users\Admin\AppData\Local\Temp\dfrgui.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2016
            • C:\Users\Admin\AppData\Local\Temp\dfrgui.exe
              "C:\Users\Admin\AppData\Local\Temp\dfrgui.exe"
              6⤵
                PID:4948
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 800
                6⤵
                • Program crash
                PID:412
          • C:\TEMP\Arkei1.exe
            "C:\TEMP\Arkei1.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4104
            • C:\Users\Admin\AppData\Local\Temp\BlueScreenView.exe
              "C:\Users\Admin\AppData\Local\Temp\BlueScreenView.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:4396
              • C:\Users\Admin\AppData\Local\Temp\BlueScreenView.exe
                "C:\Users\Admin\AppData\Local\Temp\BlueScreenView.exe"
                6⤵
                  PID:1812
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 800
                  6⤵
                  • Program crash
                  PID:1772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4396 -ip 4396
        1⤵
          PID:3100
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2016 -ip 2016
          1⤵
            PID:3308

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\ZX Comany\Setup\11.bat

            Filesize

            49B

            MD5

            9c5ff437f1c8df2188522588a13d8a39

            SHA1

            c7659b5e9231fba6de6337aa61945b4cf35fc6f9

            SHA256

            f629d747c54a3cba4c7ff7a961fd23022a1ad8fe6f988f94037f4ab1160a9a27

            SHA512

            b7c6e6e453d20d5b8a736e526dcbfcbc1c7668bf2f78c2768b5d68dc2016e50bfb7e8267f373b3390559558ffbcd245ce4c75c94bda417377cc7ce3f1aea1079

          • C:\Program Files (x86)\ZX Comany\Setup\rar.exe

            Filesize

            1.7MB

            MD5

            66aff81a4148ac26ee7e57627e2ecbc7

            SHA1

            9d6b2264f1cfeadb556b1fe880a965102e3c557f

            SHA256

            7fb160efad7efd2ee2deacf99f63f433fc4b58c714a678e34a3e5e162e99f1be

            SHA512

            721a00c68fa913ede6d5b45bb3e01c4f863c0614af224ca98585a548b37c953eaaf91eb275e62ef9e392c400d1f346ee3dbbe91a815c89f2afa381cc2c3551e9

          • C:\TEMP\44.exe

            Filesize

            879KB

            MD5

            343ab41be912e2fd47c5b440adea8283

            SHA1

            9172aeccb1a9373bef8e37893fe3b64624326dd1

            SHA256

            20ed4aa51c59153dc2eec8a610467fb3a7eb38474ef6ec179c3b71e1ffbcce59

            SHA512

            e8f6d009caf7f3b5a9980614b5c0a50115cdcb8f0999edb9af7587e65017c61e484def72650cd5ab81279e5a99f21111c9677b1a21fa1ad3c3e8aa3913b095ad

          • C:\TEMP\Arkei1.exe

            Filesize

            832KB

            MD5

            568712e628008b963d6c40a12f10ac00

            SHA1

            3bc8567a248cffd1ac43d8fa47edb5eee6bd65b0

            SHA256

            45c2a05d843c448491a4f31f06db4bfe5553ebba2a9d990317cd2cb0dabff30b

            SHA512

            e15e7c7f7f1c9a5f168b2d5fa28a0b28f3ff67ada0b5837bfac98e1f9e04074b51eed2721a4b6de60dfc7198042031fa2bea003cff75fd0718714ecbeb522735

          • C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp

            Filesize

            8.0MB

            MD5

            9e5061f48550753fd4a67bced21d31e6

            SHA1

            6cdd2e6ec542d585b5481ab6fbaf64f1eab1658d

            SHA256

            8aa8301129281f1a4d1aa9eba37e69282fd1d68f084455a9a25f5db3f158c7b3

            SHA512

            c5d079f3375a2ddeab9daa54b83ede12960ee507428aae1a06431b7f905b1a4cd71c6f98d34c78131d52818ed0f3324b48b59d40baa24c8b7d775a3c0fae1871

          • C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp

            Filesize

            5.2MB

            MD5

            9380743a114a72fdd83ae0d9bc7ecc82

            SHA1

            b378df8008977d1d57a24874936b19f8ae4b1553

            SHA256

            41c2200ffdbf809d9898747753421f0a59a7989c412696af7dae1bdca172bc80

            SHA512

            d3ec0f19dabd6568c7c4b8feeaf6320c88a91dae4dc5b7589900d7eb1ba94d0f634fc5fbe4e8a43f52b56417e4bd2faa3739325c500b22c73df66ddd04d42824

          • C:\Users\Admin\AppData\Local\Temp\BlueScreenView.exe

            Filesize

            654KB

            MD5

            7399f9bec3517e33cb548b00414c49da

            SHA1

            32630a25c5adc819f6ce491bd13ba850a29eae9d

            SHA256

            ade8f7dfecdc7bcadb1686ea34682305cb9613c7cde67ed55dd319050e9de145

            SHA512

            0280c5b55ea1dce71f9b2ddbfe0bac2f030d4d87a830bce1e89807876ae9d12f48045b3123e20f6859c1089d443751fa9204d2487d1b58264a1ad7e32d2e1c06

          • C:\Users\Admin\AppData\Local\Temp\dfrgui.exe

            Filesize

            763KB

            MD5

            9f3bf0c3af2387816095511aeee7ffc4

            SHA1

            0e7eb78ffdeba6bc3806c946cf5e5a3f62f89201

            SHA256

            eb082d0c9627b183fdcd688a92b3589f9ea7c2a585c31f1ccad681fc5a54adb0

            SHA512

            3ebd8e3f83e91a7ef55df422aefcde11156d20c0fb0c489ee9f3d46f96f428639a1ec49e27680c2cd94b35a786ed440a680e6b12ec5fc56b0499e68545015a49

          • C:\Users\Admin\AppData\Local\Temp\nsu6C58.tmp\System.dll

            Filesize

            11KB

            MD5

            3f176d1ee13b0d7d6bd92e1c7a0b9bae

            SHA1

            fe582246792774c2c9dd15639ffa0aca90d6fd0b

            SHA256

            fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

            SHA512

            0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

          • memory/644-63-0x0000000000400000-0x0000000000433000-memory.dmp

            Filesize

            204KB

          • memory/4104-124-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-126-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-93-0x0000000004E60000-0x0000000004F1E000-memory.dmp

            Filesize

            760KB

          • memory/4104-94-0x0000000004F20000-0x00000000054C4000-memory.dmp

            Filesize

            5.6MB

          • memory/4104-119-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-120-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-122-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-128-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-96-0x0000000004D90000-0x0000000004E4C000-memory.dmp

            Filesize

            752KB

          • memory/4104-134-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-136-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-140-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-138-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-132-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4104-130-0x0000000004D90000-0x0000000004E46000-memory.dmp

            Filesize

            728KB

          • memory/4412-106-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-108-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-95-0x0000000004D50000-0x0000000004E0E000-memory.dmp

            Filesize

            760KB

          • memory/4412-110-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-114-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-116-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-104-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-103-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-101-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-99-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-112-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-118-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB

          • memory/4412-92-0x0000000004E20000-0x0000000004EDE000-memory.dmp

            Filesize

            760KB

          • memory/4412-97-0x0000000004D50000-0x0000000004E06000-memory.dmp

            Filesize

            728KB