Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 09:06

General

  • Target

    1ab50a64b28eb24c4ba25cce1e4a10b3_JaffaCakes118.exe

  • Size

    782KB

  • MD5

    1ab50a64b28eb24c4ba25cce1e4a10b3

  • SHA1

    97e6fc6e2d7a39c54b07ccb2b7398d73ba287eba

  • SHA256

    2f61675e9ea414fbad8c9f174b0318acc0e968d31cfdbc8f69443ec234a9c495

  • SHA512

    00702a4917dc61c3c9882b88380462326a6abf571081d52bf3ae0679e2adaed84d2906dc63507e87485360f001406fc692da3391851d2c4371b4020877865a49

  • SSDEEP

    12288:YOlx4kk9HKda4YfM/1T3PPSnPI2VAWNDTJHq9DIMTW8c10:YA4Ya1fQzPPSnPFqWtTJK9DIMTW8F

Score
10/10

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ab50a64b28eb24c4ba25cce1e4a10b3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1ab50a64b28eb24c4ba25cce1e4a10b3_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Users\Admin\AppData\Local\Temp\ruifw.exe
      "C:\Users\Admin\AppData\Local\Temp\ruifw.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Users\Admin\AppData\Local\Temp\enenh.exe
        "C:\Users\Admin\AppData\Local\Temp\enenh.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1880
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
        PID:2548

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

      Filesize

      304B

      MD5

      0bafbfab87bed5a68670dccfce80ec2a

      SHA1

      59941ca8fb894dab95292ae3068e393228101c5c

      SHA256

      0a7200da2766b3ed8bb8b1a34a3750f8fead7b4ef4cc335a8c41ba8eee51de21

      SHA512

      b605df17f2d30b7d807c6e0fbcbcc23d6681277e566aa776f6b47b118967ce7094de7e1684a96db35c7929d4d5028aae4697ef3fa1f9d46bac360a185dfa8a35

    • C:\Users\Admin\AppData\Local\Temp\enenh.exe

      Filesize

      156KB

      MD5

      700c1bf7323086517042e1bd399735bc

      SHA1

      9359d877f5491e5bad533813b2fc7bb27c69c4c2

      SHA256

      c3a4a53898de8778627abbef3c0f53ce773aa4f23f589db3e9bb04dbf4adbfd6

      SHA512

      3bbf7ad8377b6005fafbc5013ad9a69d91346f821ea18125904555a672a4966e1efefdff71112f8b623046685dc00ab30ff34dab48dcc051e0f7b83082f16a85

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      3909f8cbee226433e7a430d0e671fe11

      SHA1

      9394c08b04202ae410e31d0773a42bd86f655471

      SHA256

      c8ec038345b065a9e59e00c02e106cab52fcc37da89e338753ed2232f62dba2d

      SHA512

      128b0d9553a1a38ddabbb5390f50e8a2a13b3e45ace056bcab70e6c098119af7d851c2a4723c6509bd22db91468cfa805b8d7d5dc43bc373b28155ceda84252f

    • C:\Users\Admin\AppData\Local\Temp\ruifw.exe

      Filesize

      782KB

      MD5

      4d71d2d452d3740c5cb715e871cabe5a

      SHA1

      dcb0728c44f36809010b16e7abf1a720da7ab5be

      SHA256

      78161e577d76aa4253ff4323c844da11497daa302a9ec0789f87e56d9206876d

      SHA512

      d71cc39bde6ba8f2ef40a47b40f32984bd54d67bb4047e20ba51cf6ea5d2682f3d4f3721d54a42a6dec2ae307522e72122d8700e1c3f7094620290dd08cd735a

    • memory/1880-27-0x00000000004E0000-0x00000000004E2000-memory.dmp

      Filesize

      8KB

    • memory/1880-26-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1880-30-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1880-31-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1880-32-0x00000000004E0000-0x00000000004E2000-memory.dmp

      Filesize

      8KB

    • memory/1880-33-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1880-34-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/1880-35-0x0000000000400000-0x000000000048F000-memory.dmp

      Filesize

      572KB

    • memory/2676-17-0x0000000000CF0000-0x0000000000DB9000-memory.dmp

      Filesize

      804KB

    • memory/2676-10-0x0000000000CF0000-0x0000000000DB9000-memory.dmp

      Filesize

      804KB

    • memory/2676-28-0x0000000000CF0000-0x0000000000DB9000-memory.dmp

      Filesize

      804KB

    • memory/3876-14-0x00000000007F0000-0x00000000008B9000-memory.dmp

      Filesize

      804KB

    • memory/3876-0-0x00000000007F0000-0x00000000008B9000-memory.dmp

      Filesize

      804KB