155a64eb70fb341ff15673b9d7d781dbbdafba0e70bc655ba56cbd8e2c5b15c3

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe
Size

2.1MB
MD5

18e2ee22515383ab71d88a514b75e194
SHA1

bcc90302763fcb83af8c162a9e7b1482769ba981
SHA256

155a64eb70fb341ff15673b9d7d781dbbdafba0e70bc655ba56cbd8e2c5b15c3
SHA512

8955fe3022877c500fdcc616482c6acc94adfe9d962ea83de1ffe7a39b19d8685dc11eab40bb2f4622d957c01ccfff123538b830461ecb970122a24b41cbc056
SSDEEP

24576:VlPE7KG8nmak4jqelV6zAaDA5Y/tLt+nj6bm:kYPXsD2+SjW

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,"	YingJie Killer.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	Sender2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	Sender2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
3660	meocondethuong70.exe
3288	Sender2.exe
2056	YingJie Killer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002341f-28.dat	upx
behavioral2/memory/2056-49-0x0000000000400000-0x0000000000536000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\meocondethuong70.exe"	meocondethuong70.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2056-49-0x0000000000400000-0x0000000000536000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\OLE32Init.exe	Sender2.exe
File created	C:\Windows\SysWOW64\OLE32Init.exe	Sender2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\regsvr32.exe	Sender2.exe
File created	C:\Windows\regsvr32.exe	Sender2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2056	YingJie Killer.exe
2056	YingJie Killer.exe
2056	YingJie Killer.exe
2056	YingJie Killer.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1636	Process not Found
2192	Process not Found
992	Process not Found
924	Process not Found
3924	Process not Found
3996	Process not Found
2428	Process not Found
4396	Process not Found
3232	Process not Found
1076	Process not Found
3060	Process not Found
4872	Process not Found
536	Process not Found
4844	Process not Found
4972	Process not Found
4132	Process not Found
3260	Process not Found
4860	Process not Found
4892	Process not Found
1964	Process not Found
3532	Process not Found
4360	Process not Found
4304	Process not Found
1920	Process not Found
5116	Process not Found
4436	Process not Found
4544	Process not Found
2600	Process not Found
2200	Process not Found
4236	Process not Found
5088	Process not Found
2268	Process not Found
1056	Process not Found
2128	Process not Found
3936	Process not Found
848	Process not Found
2248	Process not Found
2144	Process not Found
2708	Process not Found
2292	Process not Found
4408	Process not Found
4496	Process not Found
1388	Process not Found
3240	Process not Found
840	Process not Found
876	Process not Found
3692	Process not Found
2236	Process not Found
944	Process not Found
1192	Process not Found
1756	Process not Found
764	Process not Found
1404	Process not Found
608	Process not Found
4272	Process not Found
4280	Process not Found
4352	Process not Found
1092	Process not Found
1944	Process not Found
4580	Process not Found
3348	Process not Found
2168	Process not Found
5004	Process not Found
2148	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2056	YingJie Killer.exe
Token: SeDebugPrivilege	3660	meocondethuong70.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2056	YingJie Killer.exe
2056	YingJie Killer.exe
2056	YingJie Killer.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2056	YingJie Killer.exe
2056	YingJie Killer.exe
2056	YingJie Killer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3660	meocondethuong70.exe
4144	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 3660	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	84
PID 3524 wrote to memory of 3660	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	84
PID 3524 wrote to memory of 3288	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	85
PID 3524 wrote to memory of 3288	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	85
PID 3524 wrote to memory of 3288	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	85
PID 3524 wrote to memory of 2056	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	86
PID 3524 wrote to memory of 2056	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	86
PID 3524 wrote to memory of 2056	3524	18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18e2ee22515383ab71d88a514b75e194_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Roaming\meocondethuong70.exe
  "C:\Users\Admin\AppData\Roaming\meocondethuong70.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3660
- C:\Users\Admin\AppData\Roaming\Sender2.exe
  "C:\Users\Admin\AppData\Roaming\Sender2.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3288
- C:\Users\Admin\AppData\Roaming\YingJie Killer.exe
  "C:\Users\Admin\AppData\Roaming\YingJie Killer.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2056

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39aa855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sender2.exe

Filesize
45KB

MD5
a5df875dc607d50d7039448fa427667d

SHA1
d8277d14efc10f7a944a7dd6d14212e8feb4f98b

SHA256
94c0d728920ceaadd592c42ea89d3daa3576ff0151b5fb9633d9001808dfb3e1

SHA512
a61d14c2e2cdecd5e0c7bd3d42a830dc9f2d006d5a0209c6415a12adcd0608109639f5f76e1e8a9dcd612d20cea1543a722d18e83a0173a577f059466d46db5e

Download Submit
C:\Users\Admin\AppData\Roaming\YingJie Killer.exe

Filesize
544KB

MD5
144b7347ac756854c38d2a19384d6cd2

SHA1
80effd8c17194b6b22869f9b7195ab57f44a3e68

SHA256
76d400c55c84b6272578b8c095ca584d0f19593bcaa95a6ec275640d4e75d02a

SHA512
aca5db42dd117af8680463a1ba0993d8859dae6993db589938e2fe13ba3583c143aa3aef3aa017e42fbc2f134f5a7e0b8691265bd8076cfba493b92e66340df4

Download Submit
C:\Users\Admin\AppData\Roaming\meocondethuong70.exe

Filesize
35KB

MD5
134443f7f65aff85df22a8324ac25884

SHA1
54136f14801df7682f63ebb83d2eeb91b735ff94

SHA256
c85b5284e8531eb6765e6aeba7bdf6f75250ad1792c0d6171dd2a0e58bb78eea

SHA512
5d4bbe6b77d263c446a34f516a2a8db2938fcf01f88b8b0875fa9facb4d3c610ef5519883d3c0a41c55c6ea5b47b5b6e651ea564136125d9bc131c5004cca0c0

Download Submit
C:\Windows\SysWOW64\OLE32Init.exe

Filesize
45KB

MD5
ab929b9b95092b19fcb79593dc6d4e6c

SHA1
62fd281db913e917a677ec59ca5fb340686bb610

SHA256
c2bb87dcf7f963d5c0494778e423dcd4e7b1bba905f2a0c785346c4960d3da7c

SHA512
7ecd77b79a13b6b728ef5b93039ba9cb8f1e78d52e86a50f9477beedc5167d47eff1b53d2dff8f69d1833294683108b69a22db7bc466ccefdf7d89ef8e8b9570

Download Submit
memory/2056-49-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/3288-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3288-53-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/3524-37-0x00007FFAC4580000-0x00007FFAC4F21000-memory.dmp

Filesize
9.6MB

Download
memory/3524-5-0x00007FFAC4580000-0x00007FFAC4F21000-memory.dmp

Filesize
9.6MB

Download
memory/3524-3-0x000000001C1E0000-0x000000001C6AE000-memory.dmp

Filesize
4.8MB

Download
memory/3524-0-0x00007FFAC4835000-0x00007FFAC4836000-memory.dmp

Filesize
4KB

Download
memory/3524-2-0x00007FFAC4580000-0x00007FFAC4F21000-memory.dmp

Filesize
9.6MB

Download
memory/3524-1-0x000000001BC60000-0x000000001BD06000-memory.dmp

Filesize
664KB

Download
memory/3660-47-0x00007FFAC4580000-0x00007FFAC4F21000-memory.dmp

Filesize
9.6MB

Download
memory/3660-50-0x00007FFAC4580000-0x00007FFAC4F21000-memory.dmp

Filesize
9.6MB

Download
memory/3660-51-0x00007FFAC4580000-0x00007FFAC4F21000-memory.dmp

Filesize
9.6MB

Download