Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26-07-2024 16:00
General
-
Target
74bc06afcc8fb802c5eeee61f2b01424_JaffaCakes118.exe
-
Size
872KB
-
MD5
74bc06afcc8fb802c5eeee61f2b01424
-
SHA1
8f0ed8b5f85b1d79d81510d2ed404f0d560708f3
-
SHA256
df5a612a4b3333994e26085e84e297375c27f87e86b1b63bb0ee8e7409143363
-
SHA512
0fe4cf23a5123fbced741e8adb6f23570156820c9c923c51e9e437442d9a0b9150d785bf03beae6847d37327948506870bfea7b52857f903bbdef5327825d17a
-
SSDEEP
12288:3yj3TohBlkPUEcqo6i9KBkYdR/G0QAER+3Pas4wHGlafKX9AWF8Czz:3yjDohEKui9KB7dVJu+3b4wmlO3WF8Y
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Program Files directory 30 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74bc06afcc8fb802c5eeee61f2b01424_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74bc06afcc8fb802c5eeee61f2b01424_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\\setup.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\sna.exeC:\Users\Admin\AppData\Local\Temp\\sna.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tdsetup.exeC:\Users\Admin\AppData\Local\Temp\\tdsetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\DeskAdTop\deskipn.dll" -s3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe "C:\Program Files (x86)\DeskAdTop\Run.dll" ,Rundll3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DeskAdTop\Mrup.exe"C:\Program Files (x86)\DeskAdTop\Mrup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ntfis.exeC:\Windows\SysWOW64\ntfis.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD58745c4c253f75e6b12f950eee825c720
SHA1a695f4d8bfb5f02b578916e31dd8c25d812cf6d7
SHA256c0865a3b6c45d600fa04a0cadb92277f2b51a70c477c15ec1a9a8ea415a87b8a
SHA51298dbcdc0b579309ad40976ebee7246c7b03175bca32e37c80d108f766e576c1959f295c1adb7fc2ef35c12e460df820007762105f5d09ee979a9410ea0f4b399
-
Filesize
100KB
MD5157f5fab137c377e35435ca54c81342b
SHA1ee8f3c010edd4c9372d081bf2d4299c8377c81da
SHA2563a4917128c9eed22a75558e637df27d9b1d78dbf7830133fe3c3da18cd21c13f
SHA512dd0e363e6852766b0a01b76f587a4a741b0b65cf4c93a670b076e472ed25744ca86320de0c11bcf8b07dc54a03fec94b5f5aa47bad630117db3bfc0fd946fe34
-
Filesize
32KB
MD5dcafc4fd75a69079384ed570dc534f11
SHA1087a8eebccc450155282cb07b8338907504a6eed
SHA25643e317a3c1cb4f4239eb685d14e38be7bde4413eb09c5e5903c078fcc81dc68c
SHA5123bd03e87d98a7e735f04d164fd753a01e837134fc960273f2479ba01a0bcff02241ee3d81350c88df659d78da161155d60cc77afd9c5bb19d8177e1645e52663
-
Filesize
28KB
MD5cecd38d3777d9332d23f6c55f89b33b5
SHA1a798242c512ba0c0d821f028dce26f5b98f0ac97
SHA256a5ac8f7cbc068487f761462af28313bc9a48fd3cc3bd042dca0d0a6d2f54ce9b
SHA512b2da9ce6321bb3c27863c4b88689e343c470b5b87a88767f4194e66be8fcc9d36a2e4322612e2db80e0c8d44794c9c059193569aa207f4c562152c1fc630b1cd
-
Filesize
24B
MD50d87d522011c4c250f60a3fa4e744310
SHA1e05367920ee8681b2a3ac42db2137b105b090d6f
SHA25695d50984688698344c925332224fe99578d1064df44d3b5df3169a0167be6515
SHA512e85f668da0419020e1f9bb00f34fbe29295e7fc0f995edf66f69e3ea5243ceb7260317d0d464056bfd95668f12d03d277fa86bfc4aac70564d2f9ce0387b896e
-
Filesize
135B
MD5c26bde1ed5371fae0d0edcaaf9cca068
SHA13e053fa3dff335541359248d0cf3bddd80cfc2e1
SHA2561bba2c003e4e24ddd3f8ab5b8aebba2715db4a88b8c3d6fee5968c4498ab4629
SHA512705f6e872ea648f05a39fae05b195b9a589af86cbff1ce649dba39efc45ab1a071768a0eb093f6c0055987375f17adc6d4f2d237a28e937e22a71dc007c6eab2
-
Filesize
484KB
MD545b27b8341ef36cde36cf74416c90ba8
SHA1a6f85ab8ec9326b94613fe15b4909dd255d2ee13
SHA256d335b9302e9b466815cc1c128316dadae246e9759070e34cb1ecc9c8f749313b
SHA51203cfed97c931bc8fa6d9534e1a42da61692db1776a8a3155c27f776e42397dbb937ce4d125f766ab2f089d134db378b34b78f7aa6dfe7fa4eac6db2062212079
-
Filesize
54KB
MD5a6c4df92b7dfa426ceca14210759d175
SHA1c804ca009fd94ee059fb4af305e7375759dba81a
SHA2566f969d0fe34c8873e4130b5b85b8c8810faadf18068d4aeaeccc199a5b132224
SHA5124aae93b251b9df0d71e693ac8981178f50ee27f44219d6a4d11f13134828373ce120a86f9eaf5cbe4e7da506943f10ad6fb1c6f0e3c0c44c50ee1a7a3b2ff3b8
-
Filesize
117KB
MD5426a50013aca9bd57cee7cccf0097f6f
SHA1e539c50a24e8d3cad614dbc317b97ff0b2ec2a8a
SHA256a9294cc082eb2797c08e4de90fc730fe5867536867d90bea7d63382f5602c2d1
SHA51296bf5e02e35228a71f330144617d4f71cff3c9fe0959e2614dc1ac823dd7b2966f5329219bd03c6d605f30cb164c5670017c4061fc5ccab72dba28367e96de8c
-
Filesize
408KB
MD54749bd76ab7e9eab2b29d5e9bea120aa
SHA13bd6130d80dc1869afb2cdc871ea43aa969d79c5
SHA25623ee3930e748b7fd6e786cbc6f578675a01e725d86e4e4205aa1cc4b8d25f261
SHA512a95ab7302d9205d84c3d35b6c5480e1b825ef0c54c27bf95b8d04547d78aa3a56b3e88ccf9ed53109b2208534e6795c89fb7a3a0f7dff472337acc32013c50b2
-
Filesize
6KB
MD55fe859f2d13cacd55135a14bf57dd445
SHA1679237dc33ecceb6623b996fa973bba8d5d736e5
SHA256598c1c3135c43eeea1c6028ced92b6a7c3ad1cb88149555a5c3a70b8d1bd8a7c
SHA512085129a140f00acb6397cc4563552fdd5f75f5355d383c5afe373d9664c879832738412eba4c6448e5a1e8f4866d4aa4e412df031e9d49f4faad87ad4bb3b306
-
Filesize
876KB
-
Filesize
876KB
-
Filesize
876KB
-
Filesize
172KB
-
Filesize
172KB