Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21-08-2024 01:12

General

  • Target

    b19825e5e89001fd7c06c56670b023ac_JaffaCakes118.exe

  • Size

    282KB

  • MD5

    b19825e5e89001fd7c06c56670b023ac

  • SHA1

    6b7210b800494fd6a148d7ca8414990c64108d54

  • SHA256

    40341be3547e272970b36f04b4fce4f957e297420155586305c1f8fae45dce42

  • SHA512

    c589794be4cce830a455b17685168c6678e95ad57eb8422b3832d76bcc188a048ece276bf573083c9b2da25d4cd5236c65f382717dde4f279d3de4500d048735

  • SSDEEP

    6144:n82HPKAA9jslC3NvjuqNCjV+GenP8n3JTLLe3:82HPKh9jJd/N+V+GenE3pLm

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1204
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1252
          • C:\Users\Admin\AppData\Local\Temp\b19825e5e89001fd7c06c56670b023ac_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\b19825e5e89001fd7c06c56670b023ac_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:624
            • C:\Users\Admin\AppData\Roaming\Jiutyg\wyko.exe
              "C:\Users\Admin\AppData\Roaming\Jiutyg\wyko.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of UnmapMainImage
              • Suspicious use of WriteProcessMemory
              PID:2324
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpade74e44.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:1128
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:932

          Network

            No results found
          No results found
          • 82.88.65.111:17345
            wyko.exe
            105 B
            1
          • 99.190.137.80:12109
            wyko.exe
            254 B
            1
          • 175.141.221.126:24400
            wyko.exe
            300 B
            1
          • 190.26.120.90:22952
            wyko.exe
            189 B
            1
          • 94.203.147.11:20599
            wyko.exe
            176 B
            1
          • 99.169.224.231:22266
            wyko.exe
            188 B
            1
          • 91.179.41.185:15941
            wyko.exe
            195 B
            1
          • 186.206.85.241:29592
            wyko.exe
            197 B
            1
          • 82.131.141.80:27735
            wyko.exe
            109 B
            1

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmpade74e44.bat

            Filesize

            271B

            MD5

            150b106f9600abf45da4a3c29962e2cc

            SHA1

            8f55d884ae27db3374c8445b86b46cbf85c1e8b6

            SHA256

            8c76ab15e155a332e16f491c7aac666ae3f1b301e5785eee4c62b4b1348c3ea7

            SHA512

            a025b5c996c9a5c12a9940df599a0b011bdd815ce158ea4079504680ddc38302fede7accca2a0b21234b600c8c716b8878ae4c6dfeb8e829f268d6767a2cda76

          • C:\Users\Admin\AppData\Roaming\Jiutyg\wyko.exe

            Filesize

            282KB

            MD5

            d5f5c931cd3143c7cba641f4d6fe383e

            SHA1

            bf92cddbb9f6b50a666decf9cc349c5443550783

            SHA256

            71958ed29f7d5f19123d7fc032b245688e03e139bca2df3e9aee3806a7997f6e

            SHA512

            94f527ad2bc42c4707faeb7e4a863108c9fbfeb035aec6f9274bedb0b9647532832a79461bd5710dacfd3523c4ceeae247517798f182b3be723cf979d878d779

          • C:\Users\Admin\AppData\Roaming\Xaovva\mihol.usa

            Filesize

            380B

            MD5

            0f212e0ac92a43efada2ee84e82626f5

            SHA1

            a96a7bbd6e303387bbc37e83f3db5487e62ea323

            SHA256

            16e803367a7d229d55d1e7a3441effb5ca19e141b86cb40573f695e5e9513a32

            SHA512

            9acd44caa10e0c458671aad1e1457baae552de2154798c9117247de548f81861d6dfc5260ead7dc77956d5416d913dd9f44a1a2af6fb471f4abe1f38f4a3ecb3

          • memory/624-54-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-56-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-4-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/624-3-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/624-40-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/624-42-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/624-50-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-129-0x0000000077BA0000-0x0000000077BA1000-memory.dmp

            Filesize

            4KB

          • memory/624-130-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-128-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/624-78-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-2-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/624-76-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-74-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-157-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/624-156-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/624-155-0x0000000000370000-0x00000000003BA000-memory.dmp

            Filesize

            296KB

          • memory/624-154-0x0000000000320000-0x0000000000361000-memory.dmp

            Filesize

            260KB

          • memory/624-72-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-43-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/624-1-0x0000000000370000-0x00000000003BA000-memory.dmp

            Filesize

            296KB

          • memory/624-68-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-66-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-64-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-62-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-60-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-58-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-0-0x0000000000320000-0x0000000000361000-memory.dmp

            Filesize

            260KB

          • memory/624-52-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-5-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/624-70-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-41-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/624-39-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/624-44-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-46-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/624-48-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/932-36-0x0000000001CF0000-0x0000000001D31000-memory.dmp

            Filesize

            260KB

          • memory/932-37-0x0000000001CF0000-0x0000000001D31000-memory.dmp

            Filesize

            260KB

          • memory/932-35-0x0000000001CF0000-0x0000000001D31000-memory.dmp

            Filesize

            260KB

          • memory/932-34-0x0000000001CF0000-0x0000000001D31000-memory.dmp

            Filesize

            260KB

          • memory/1116-21-0x0000000001E70000-0x0000000001EB1000-memory.dmp

            Filesize

            260KB

          • memory/1116-18-0x0000000001E70000-0x0000000001EB1000-memory.dmp

            Filesize

            260KB

          • memory/1116-19-0x0000000001E70000-0x0000000001EB1000-memory.dmp

            Filesize

            260KB

          • memory/1116-20-0x0000000001E70000-0x0000000001EB1000-memory.dmp

            Filesize

            260KB

          • memory/1116-22-0x0000000001E70000-0x0000000001EB1000-memory.dmp

            Filesize

            260KB

          • memory/1204-25-0x0000000001AE0000-0x0000000001B21000-memory.dmp

            Filesize

            260KB

          • memory/1204-27-0x0000000001AE0000-0x0000000001B21000-memory.dmp

            Filesize

            260KB

          • memory/1204-24-0x0000000001AE0000-0x0000000001B21000-memory.dmp

            Filesize

            260KB

          • memory/1204-26-0x0000000001AE0000-0x0000000001B21000-memory.dmp

            Filesize

            260KB

          • memory/1252-32-0x0000000002A80000-0x0000000002AC1000-memory.dmp

            Filesize

            260KB

          • memory/1252-31-0x0000000002A80000-0x0000000002AC1000-memory.dmp

            Filesize

            260KB

          • memory/1252-29-0x0000000002A80000-0x0000000002AC1000-memory.dmp

            Filesize

            260KB

          • memory/1252-30-0x0000000002A80000-0x0000000002AC1000-memory.dmp

            Filesize

            260KB

          • memory/2324-276-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2324-16-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2324-15-0x0000000000400000-0x000000000044A000-memory.dmp

            Filesize

            296KB

          • memory/2324-275-0x0000000000400000-0x000000000044A000-memory.dmp

            Filesize

            296KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.