be670654d2ea59dd613244236558bf5434672afc5cdf90b9baa910daafbfd489

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe
Size 164KB
Sample240721-qat8fstepq
SHA256 be670654d2ea59dd613244236558bf5434672afc5cdf90b9baa910daafbfd489
MD5 60a02bc71feda37a2922de378c468ff1
SHA1 5af13c52313597748d7d6ff5f7ad72a40c02d490
SHA512 e5e2724c4b3de6472297101c47361236ab481bf0c77c776577bc6bc921e50161fa0bc3f2c425b1adc9b6c40b1d27bb8732cd70aa264e66ac8a444607e9fc8b06
SSDEEP 3072:Mg75c9bDFdy09JuB/RVgU974KlGro2UWQRtgxC6c3ovNRdNUirqSmF7Nv5D:MgSldHmVJ974KlGM/g46cYVWimF7hV
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence upx

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "services.exe"	a8.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
2536	QvodSetupPlus3.exe
2976	a8.exe
3556	~24066585.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023430-5.dat	upx
behavioral2/memory/2536-17-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/files/0x000800000002348c-16.dat	upx
behavioral2/memory/2976-20-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2536-23-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2976-24-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2536-25-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2976-26-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2976-27-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2536-28-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2976-29-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2536-38-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2976-39-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2536-42-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2536-44-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2536-46-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2536-48-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2536-54-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2536-58-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfig = "C:\\Windows\\system32\\PQcXe.exe"	a8.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PQcXe.exe	a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
2976	a8.exe
3556	~24066585.exe
3556	~24066585.exe
3556	~24066585.exe
3556	~24066585.exe
3556	~24066585.exe
3556	~24066585.exe
3556	~24066585.exe
3556	~24066585.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	a8.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2536	QvodSetupPlus3.exe
2536	QvodSetupPlus3.exe
2536	QvodSetupPlus3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2536	QvodSetupPlus3.exe
2536	QvodSetupPlus3.exe
2536	QvodSetupPlus3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2536	3000	60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe	85
PID 3000 wrote to memory of 2536	3000	60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe	85
PID 3000 wrote to memory of 2536	3000	60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe	85
PID 3000 wrote to memory of 2976	3000	60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe	86
PID 3000 wrote to memory of 2976	3000	60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe	86
PID 3000 wrote to memory of 2976	3000	60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe	86
PID 2976 wrote to memory of 3556	2976	a8.exe	100
PID 2976 wrote to memory of 3556	2976	a8.exe	100
PID 2976 wrote to memory of 3556	2976	a8.exe	100
PID 3556 wrote to memory of 1584	3556	~24066585.exe	101
PID 3556 wrote to memory of 1584	3556	~24066585.exe	101
PID 3556 wrote to memory of 1584	3556	~24066585.exe	101

C:\Users\Admin\AppData\Local\Temp\60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60a02bc71feda37a2922de378c468ff1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe
  "C:\Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\a8.exe
  "C:\Users\Admin\AppData\Local\Temp\a8.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\~24066585.exe
    C:\Users\Admin\AppData\Local\Temp\~24066585.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QvodSetupPlus3.exe

Path C:\Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe
Size 149KB
SHA256 eae20a59c483e08d98b03e9367af8069ae78133240f0ad73077db1f5f63c1e39
MD5 a3de6c880f4fbe1c2fdae63bed2587c5
SHA1 d24408ca4349f83b66409e773fab10863469a1f6
SHA512 218523a61e1cb2da1e2f92170965bcb51f3dc006365be606cd3d19fe8abe54c6c59674c161febdeacdc0fa8974a5ed1bfe00471c1762184026646cbc9881d12e
SSDEEP 3072:R6t/IBfTcxp5nZvc6I/5lgWTq1t64khlb+dXwVSpxP:R6pxp5nS5KWm1tI7b+yVuP
MD5 SHA1 SHA512 SSDEEP

Submit Download

a8.exe

Path C:\Users\Admin\AppData\Local\Temp\a8.exe
Size 28KB
SHA256 d60deb1a1ab9703de259c49da2d9dfaf9f4c420a2addec05f79598fbb8796fb8
MD5 492744ed06cf431587752fa50ed19e5e
SHA1 847efe89e28ec4ed93f94dc539ccbeccad1ea3f7
SHA512 6e33943c1b3959fe8a68e23734c19510833b7d0729280ca794dbdc2d8535e13959c7287a48e7bf9f88922ade0117f3e0f9728e2a78b5d06a98a3065655b38da5
SSDEEP 384:0VwBCg7Olb5lFvXDnbGsio7ufRSauyzix5GpyjNRPxGPJctP35nNYJLPGBq:Ww0gSjvzVio7u8autayTxGqPJn4Lgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

~24066585.exe

Path C:\Users\Admin\AppData\Local\Temp\~24066585.exe
Size 8KB
SHA256 fc9cbd7255af9457bb83bf0c8e3112137a62080cc6a92933e5e49972c6ce4099
MD5 ad89bc7bf72615975b36c9ab8cad3802
SHA1 073deffbc230613b7ac96da089a23ac3e0ea05b8
SHA512 3ecf7504381942df46fab448b0ca07c0e6ece1970a9752ba15250ef11847676afb889af93f1eae35372b45fad2b98f1c269deeeee21ce960ecd8f30d78733f1f
SSDEEP 192:bQLer4ebLBSZAD3Fbm2lXJc0pyWvMjtrXAQVrIkWf/DCWP:DrTfYZ3GowQVr5Wf/DCWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2536-23-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-58-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-54-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-38-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-48-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-25-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-46-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-44-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-28-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-42-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2536-17-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/2976-39-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2976-29-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2976-27-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2976-26-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2976-24-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2976-20-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3000-0-0x0000000000400000-0x000000000042A8C7-memory.dmp

Download

memory/3000-22-0x0000000000400000-0x000000000042A8C7-memory.dmp

Download