Overview

overview

7

Static

static

5

9153102c81...18.exe

windows7-x64

7

9153102c81...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 09:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9153102c81da5499128dbd74f10a2623_JaffaCakes118.exe
  • Size 561KB
  • Sample240603-lref4sbg22
  • SHA256 ea3442ec3d9de403867827034d631727a664677c369c656b669b3944fe078369
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 11 IoCs
    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 22 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9153102c81da5499128dbd74f10a2623_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9153102c81da5499128dbd74f10a2623_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Windows\SysWOW64\WindowsUpdate.com
      "C:\Windows\system32\WindowsUpdate.com"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\SysWOW64\WindowsUpdate.com
        "C:\Windows\system32\WindowsUpdate.com"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies Control Panel
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Windows\SysWOW64\WindowsUpdate.com
          "C:\Windows\system32\WindowsUpdate.com"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Control Panel
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3012
          • C:\Windows\SysWOW64\WindowsUpdate.com
            "C:\Windows\system32\WindowsUpdate.com"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies Control Panel
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5044
            • C:\Windows\SysWOW64\WindowsUpdate.com
              "C:\Windows\system32\WindowsUpdate.com"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Modifies Control Panel
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3796
              • C:\Windows\SysWOW64\WindowsUpdate.com
                "C:\Windows\system32\WindowsUpdate.com"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies Control Panel
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5108
                • C:\Windows\SysWOW64\WindowsUpdate.com
                  "C:\Windows\system32\WindowsUpdate.com"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies Control Panel
                  • Suspicious use of WriteProcessMemory
                  PID:4140
                  • C:\Windows\SysWOW64\WindowsUpdate.com
                    "C:\Windows\system32\WindowsUpdate.com"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Modifies Control Panel
                    • Suspicious use of WriteProcessMemory
                    PID:4292
                    • C:\Windows\SysWOW64\WindowsUpdate.com
                      "C:\Windows\system32\WindowsUpdate.com"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Modifies Control Panel
                      • Suspicious use of WriteProcessMemory
                      PID:1900
                      • C:\Windows\SysWOW64\WindowsUpdate.com
                        "C:\Windows\system32\WindowsUpdate.com"
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies Control Panel
                        PID:3308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
        • Size 1KB
        • SHA256 46d3ed9486f6c000d1e52b27979054fdbd340efe906522441306ea0c189276b6
        • MD5 SHA1 SHA512
        Submit Download

        D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
        • Size 979B
        • SHA256 d3a4273f83db93b4afe9c06918806d71e6268a4b8b41cee65e047cfaa1af548f
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
        • Size 482B
        • SHA256 2000f664a0d9f23203d643f2772dab5e4408fc489dd3a2367e143058b6c193fe
        • MD5 SHA1 SHA512
        Submit Download

        D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
        • Size 480B
        • SHA256 3f5f2a840ab58e776847fa3305e6a48d1ee0a03357b8b23354fa2473b3c5e55b
        • MD5 SHA1 SHA512
        Submit Download

        roflhamster1[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\roflhamster1[1].htm
        • Size 162B
        • SHA256 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
        • MD5 SHA1 SHA512
        Submit Download

        WindowsUpdate.com
        • Path C:\Windows\SysWOW64\WindowsUpdate.com
        • Size 561KB
        • SHA256 ea3442ec3d9de403867827034d631727a664677c369c656b669b3944fe078369
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 3B
        • SHA256 a15faf6f6c7e4c11d7956175f4a1c01edffff6e114684eee28c255a86a8888f8
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 b33ed571eded536f0f0bc2be4e4384055acd592fe6652a555320fdca4dbeb175
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 6c6ece85b5d6ea8c5b1901b34909d170569478006b74472e49d7535ab4b4a94d
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 e3c80264bcf6bde782c4d6f2d5c25c1d5b1cf668ae9a91711a463e8ae9d578bd
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 ae1f31e1ba28b07bde594969df8f0121931f39f7e83c632ab974ee5fe1c78245
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 6beb5eb7eefdd7dada9588445e3b6485c1f68eac97d0b105aa18e59ecd0f35b3
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 8032b67b62f573e47ebc2aa6cf225750b1cfcb3f33fa6575647728f9eeb0ccbb
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 1f74494f923e9bf4bedc9968f0418824c2b298bd83009812a45e547f6733ac7b
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 bcdc35b056897c2743a1371bc4bc1652e8a1c2b7b6fc7c65788bb412b6a0bf52
        • MD5 SHA1 SHA512
        Submit Download

        windebug1923dd.log
        • Path C:\Windows\windebug1923dd.log
        • Size 4B
        • SHA256 e41d64db5703c6440b5c714d57251a845bc0bd241480b41a4e7fd3e052f85a82
        • MD5 SHA1 SHA512
        Submit Download

        memory/744-0-0x0000000000400000-0x0000000000497000-memory.dmp
        Download