Overview
overview
10Static
static
36f2f7f2ce0...18.exe
windows7-x64
106f2f7f2ce0...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Setupres.exe
windows7-x64
9Setupres.exe
windows10-2004-x64
9VMProtectSDK32.dll
windows7-x64
1VMProtectSDK32.dll
windows10-2004-x64
1ipras.vbs
windows7-x64
8ipras.vbs
windows10-2004-x64
8Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
6f2f7f2ce0ef33d170cf9ee67265770d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6f2f7f2ce0ef33d170cf9ee67265770d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Setup.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Setupres.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Setupres.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
VMProtectSDK32.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
VMProtectSDK32.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
ipras.vbs
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
ipras.vbs
Resource
win10v2004-20240226-en
General
-
Target
Setupres.exe
-
Size
2.0MB
-
MD5
e75b71aa66f4177b62485503809ec837
-
SHA1
8203e06f29d51c25b2af48c62fa6074c58958660
-
SHA256
f2ac71dbbc1ec524d93811dd4cd64edc5c836be379fa9cfd565af7ba45cfe80c
-
SHA512
2761d0880e60a87b9cca31cd533f626b218ddf9939dbd751cc468904500d19a59e63c09af0f44ede21bbf8a416ec05b08ac7f6629cf7de1072323b349d9df2f7
-
SSDEEP
49152:b82GHJEEqZj0HcfkfXhgW7Xvn0/55ScrQI+HKU/Z:b48foR370hFrzIZ
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setupres.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setupres.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setupres.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setupres.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setupres.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setupres.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Setupres.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Setupres.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine Setupres.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setupres.exepid process 3648 Setupres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Setupres.exepid process 3648 Setupres.exe 3648 Setupres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setupres.exe"C:\Users\Admin\AppData\Local\Temp\Setupres.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\tybgrfed.exeFilesize
13KB
MD51a0c98a29303afbc07ae7a326aa6187e
SHA1c1de9150e54fcb2747ea952356db2bceadd2474f
SHA2564f568a62c3d42a91beb5b7c3466cd0ace60ea2706b94fba4f18fa704729eaa25
SHA512db9006e761d53517abbe805c7a96b106b51daf164a9f105839f825f0ea7ef717155d81b841072cf7cc8ab02b91cf5de7e188a7fa2ea779fef9f5d2d8ac64b9f0
-
C:\Users\Admin\AppData\Roaming\yhtgrfecd.exeFilesize
13KB
MD59b1fe7b98ad5dfe46d13615ed6a68cf7
SHA18d589ddd573193139f4b6e2e73e036de57fccd49
SHA256dd840f00db40d82ce0b5bc048c7ad068e2cc142fdc3830818d7df562f1e8f741
SHA512ba3ff1f024cb64bfcf8ab6863a253a06b84e84cb7215cc0d7ecbe0076dda849f03e7394ccff0126716bc3b463a8fd74952d956eb8ebb622572e6badc66f314fc
-
memory/3648-18-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-60-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-7-0x0000000009E50000-0x0000000009E51000-memory.dmpFilesize
4KB
-
memory/3648-20-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-5-0x0000000009E20000-0x0000000009E21000-memory.dmpFilesize
4KB
-
memory/3648-4-0x0000000009E70000-0x0000000009E71000-memory.dmpFilesize
4KB
-
memory/3648-3-0x0000000009DC0000-0x0000000009DC1000-memory.dmpFilesize
4KB
-
memory/3648-2-0x0000000009E40000-0x0000000009E41000-memory.dmpFilesize
4KB
-
memory/3648-10-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-11-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-12-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-13-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-14-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-15-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-16-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-17-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-0-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-19-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-6-0x0000000009E30000-0x0000000009E31000-memory.dmpFilesize
4KB
-
memory/3648-8-0x0000000009F80000-0x0000000009F81000-memory.dmpFilesize
4KB
-
memory/3648-27-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-26-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-28-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-9-0x0000000000401000-0x000000000045D000-memory.dmpFilesize
368KB
-
memory/3648-39-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-40-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-41-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-42-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-43-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-1-0x0000000077724000-0x0000000077726000-memory.dmpFilesize
8KB
-
memory/3648-55-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-56-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-57-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-58-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-59-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-21-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/3648-61-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB