Overview
overview
8Static
static
34a08970b50...18.exe
windows7-x64
74a08970b50...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3BurningGUIS.dll
windows7-x64
1BurningGUIS.dll
windows10-2004-x64
1MPEG2Transfer.dll
windows7-x64
3MPEG2Transfer.dll
windows10-2004-x64
3TotallyFre...er.exe
windows7-x64
7TotallyFre...er.exe
windows10-2004-x64
7VideoDVDBurner.exe
windows7-x64
6VideoDVDBurner.exe
windows10-2004-x64
6Winaspi/RELNOTES.doc
windows7-x64
4Winaspi/RELNOTES.doc
windows10-2004-x64
1Winaspi/aspichk.exe
windows7-x64
1Winaspi/aspichk.exe
windows10-2004-x64
1Winaspi/aspiinst.exe
windows7-x64
1Winaspi/aspiinst.exe
windows10-2004-x64
1Winaspi/aspixp.sys
windows7-x64
1Winaspi/aspixp.sys
windows10-2004-x64
1Winaspi/install.bat
windows7-x64
1Winaspi/install.bat
windows10-2004-x64
1Winaspi/reg_xp.exe
windows7-x64
8Winaspi/reg_xp.exe
windows10-2004-x64
8Winaspi/wnaspi64.dll
windows7-x64
1Winaspi/wnaspi64.dll
windows10-2004-x64
1Winaspi/wnaspixp.dll
windows7-x64
1Winaspi/wnaspixp.dll
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
4a08970b50383c600ae2377d2e11774d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a08970b50383c600ae2377d2e11774d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
BurningGUIS.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
BurningGUIS.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
MPEG2Transfer.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
MPEG2Transfer.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
TotallyFreeDVDTranscoder.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
TotallyFreeDVDTranscoder.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
VideoDVDBurner.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
VideoDVDBurner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Winaspi/RELNOTES.doc
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Winaspi/RELNOTES.doc
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Winaspi/aspichk.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Winaspi/aspichk.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Winaspi/aspiinst.exe
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Winaspi/aspiinst.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Winaspi/aspixp.sys
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
Winaspi/aspixp.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
Winaspi/install.bat
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
Winaspi/install.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Winaspi/reg_xp.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Winaspi/reg_xp.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Winaspi/wnaspi64.dll
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Winaspi/wnaspi64.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
Winaspi/wnaspixp.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Winaspi/wnaspixp.dll
Resource
win10v2004-20240709-en
General
-
Target
TotallyFreeDVDTranscoder.exe
-
Size
1.1MB
-
MD5
01edc9161fb7551e24e4a67013515f45
-
SHA1
753e7b8daf4d01cb1e706323fa04c1700a511211
-
SHA256
a5e16815bc011ad5bcf0b260529efca60ab5e6f25855effbeada97ee4f45a154
-
SHA512
537991d3ade7176a50802a078cef56f5be668a1a95b3ce61b4728fb1a8cb128f302dcb4b4e6eb36e8b07201208d678f672024d954f4de098e2f6da1701181c72
-
SSDEEP
24576:ew0ijaQMbsdcyFz+aLAos/YfU+2shL4BSMPg/:ew0Eubs6K+Ug/YfvCBxY/
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion TotallyFreeDVDTranscoder.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate TotallyFreeDVDTranscoder.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EBAFD3-57AF-6888-27DC-8B0DCE286BBE}\ = "HandWritingSkinProps Class" TotallyFreeDVDTranscoder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EBAFD3-57AF-6888-27DC-8B0DCE286BBE}\InprocServer32 TotallyFreeDVDTranscoder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EBAFD3-57AF-6888-27DC-8B0DCE286BBE}\InprocServer32\ = "%CommonProgramFiles%\\microsoft shared\\ink\\tipskins.dll" TotallyFreeDVDTranscoder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EBAFD3-57AF-6888-27DC-8B0DCE286BBE}\InprocServer32\ThreadingModel = "Apartment" TotallyFreeDVDTranscoder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EBAFD3-57AF-6888-27DC-8B0DCE286BBE} TotallyFreeDVDTranscoder.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1460 TotallyFreeDVDTranscoder.exe Token: SeIncBasePriorityPrivilege 1460 TotallyFreeDVDTranscoder.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1460 TotallyFreeDVDTranscoder.exe