Overview

overview

10

Static

static

3

df9f83686c...18.exe

windows7-x64

10

df9f83686c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 06:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe

  • Size

    556KB

  • MD5

    df9f83686c697a68d57f5983d39f52ee

  • SHA1

    46ae2d9fa980e492d59f67ed20ab0803c05d81ea

  • SHA256

    53bdb5ed28aaac05555364dcc5dafb711d5f1f9d1b1f75b2956db56ba37adc6c

  • SHA512

    47a98791bc2ae5555ca31391e4493be27d2f6d7c6be8bbd2f900fa281ba2b9cf447fc9be7ee70c6afb506b3495b0c8264ea508f9a762432ccb6b3b2b23b7f482

  • SSDEEP

    6144:lj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionr:t6onxOp8FySpE5zvIdtU+Ymef

Score
10/10
defense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • UAC bypass 3 TTPs 13 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 29 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 38 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\hnsqubwcrxc.exe
      "C:\Users\Admin\AppData\Local\Temp\hnsqubwcrxc.exe" "c:\users\admin\appdata\local\temp\df9f83686c697a68d57f5983d39f52ee_jaffacakes118.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:468
      • C:\Users\Admin\AppData\Local\Temp\wfipr.exe
        "C:\Users\Admin\AppData\Local\Temp\wfipr.exe" "-C:\Users\Admin\AppData\Local\Temp\tnbtgymiralvyhtt.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:3824
      • C:\Users\Admin\AppData\Local\Temp\wfipr.exe
        "C:\Users\Admin\AppData\Local\Temp\wfipr.exe" "-C:\Users\Admin\AppData\Local\Temp\tnbtgymiralvyhtt.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:3980
    • C:\Users\Admin\AppData\Local\Temp\hnsqubwcrxc.exe
      "C:\Users\Admin\AppData\Local\Temp\hnsqubwcrxc.exe" "c:\users\admin\appdata\local\temp\df9f83686c697a68d57f5983d39f52ee_jaffacakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Safe Mode Boot

1
T1562.009

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    89a8f6b25a8ee23f5adcb7922be59620

    SHA1

    7b1307d008f87eba2d3090ec71c16cc022506ee6

    SHA256

    794044bbae91143ab4b6d5d7d1b8e17bc8ac6a41cbcb9e24b54dd8313e9bf503

    SHA512

    7aeb0da01711321842ed0b6388bd3d30ca4932594c69d8149e58f8b3e7b07e4cbf56152b7d7e8fa83ab785bc7f2bc2dd9355054257abaf089040f30e4bc56ff9

    Download Submit

  • C:\Program Files (x86)\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    5613c6ac2a463ccf39f4600b44977d28

    SHA1

    cbab04215ce29907fd0c39742a29abd617ea516c

    SHA256

    670b356a724deadcf5c0d22fa2238013459896003a5aee6aa2560bc02cfe9b7a

    SHA512

    5ae6930dc89762048245f4a286ed6ab09b4a33f1f99477738de71e705f20e4a6c06d6b8ebc790abdc824eb80e0d857c86f2f99d7753e3898654a6130e161d1f7

    Download Submit

  • C:\Program Files (x86)\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    851e416593e0fd73d2371d59e3922a28

    SHA1

    dae0d2936a59265126cf43f9f11cfe1b22511be6

    SHA256

    a835c01d3052d1bf8cc8dc0fe2eca7bbf75dbeb0d98684c8623c7f5659ccbbcb

    SHA512

    643d7ef015cdc5832539172780213de508e3a87e3ca970188965f3386c5568dcfdcbfd0856b4f3a918caa50f3760d591b247d5bd63664e3a8c90386b785a3bc0

    Download Submit

  • C:\Program Files (x86)\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    4f435978212251cd885d4eac5cb62b7c

    SHA1

    d78ec35e43010830e4543d62c72ed3437615944f

    SHA256

    d03b6178047365c23ebbfc6f3867e69063302f7d98b0de9071e0af7e94a7db08

    SHA512

    273003ff2763fcd7ce3515dc26230134b9c17b0b6b5a411c021cad90adf36ef2ec8c66adfd374bda18aebe76ec6b83b50dd7abc5f18eea186482bf7e77357a85

    Download Submit

  • C:\Program Files (x86)\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    38779710ad4763d43b12c815b6128799

    SHA1

    d3a46fa3b085ffc66b06687c1799148a8ba13f4a

    SHA256

    d48ca2ecb3718c88a1f7a00232995bdf542087ed759034450108350d18baa2e6

    SHA512

    5eadd6f9cd60979d976f05e11f378e3c2c4c48566978f825b8338a7dee3638401b98b636c972546ee52e56ce55113da2979a3b87a416d61ca83410a9f5555668

    Download Submit

  • C:\Program Files (x86)\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    d16ca8cf4a240e67f7a37354376ddbcc

    SHA1

    7b9470744fd0cc802424f2f5d21b8a3c4b9caa36

    SHA256

    6e2077db3890ad3e4cc3a1e0913f751f42510a39d8bfd2ee14b2349606cc1f6d

    SHA512

    86983da975ab183734f6459b26234f40093f5f49168c71d89f29abd8180a0b790f503d3c196373ff83c72a092da31ab905742bd389797d73e62868828b3657ed

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\hnsqubwcrxc.exe
    Filesize

    320KB

    MD5

    5203b6ea0901877fbf2d8d6f6d8d338e

    SHA1

    c803e92561921b38abe13239c1fd85605b570936

    SHA256

    0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

    SHA512

    d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\wfipr.exe
    Filesize

    716KB

    MD5

    61c5c7754a60bff3ab969829a5d7eba4

    SHA1

    4dde90e974576e739c8164c9ce6837a00f5bfb68

    SHA256

    7b96da75fa9567e2090bd236faaecdc67ddf765f91eff9f8dda714f811a09fe3

    SHA512

    3e9eb64777182576ef8cd9b3b98c820186771b74defed3f12e324628decef8945c18c74b3ec35ba1ecdcd8ea4bb6627b62f25a0b19370d56aad1f73e8b1aaafa

    Download Submit

  • C:\Users\Admin\AppData\Local\lblziwgydipvuzhdkhxhvescuzelrqvdzg.tdr
    Filesize

    3KB

    MD5

    33058d81fa57eb66e3b16cb2560160d7

    SHA1

    9d79a96351d8c2c348dc80f882c794fb488b8c21

    SHA256

    914cbb99b16e504febd72005cb598705586976196c89fcf08e1381883e1c7c9d

    SHA512

    ea4f93f077d796109fed83e85a60c714010fe5a5176dc23ac5c3ebcd536a63947fe3a080efec430e3d7dfaa7a7bd825d81934d749ebe67e8206a59d0c9f5a0a7

    Download Submit

  • C:\Users\Admin\AppData\Local\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    152429121e21020bd487c12c1aa71382

    SHA1

    b410f223793ea2b4224d505ce70b5794f96f4931

    SHA256

    df749f7f748d87905029fed1123fd1ceb4a10a9171ad819f5ac868b4e7a24d6b

    SHA512

    1df4460b8b46187e23673f60aff92e20c73233e63d323d428ed11ac1e7411525100bd3bec7130b915ce2a97c0b0199c8b3f34f0921957db1a6b48f8005d7124d

    Download Submit

  • C:\Users\Admin\AppData\Local\ydcfdgfmgawrfzwhdputwux.dxr
    Filesize

    272B

    MD5

    e0fc8c5bc831d4948101546f041261f5

    SHA1

    39e683d20bd27acd95d8d536572ad90d18e5313c

    SHA256

    99892f5788a1a10548b5880ebc6146af6c5e5a6954d8dde04f2aae0cd41aae74

    SHA512

    16f9e8be47302632ae903ce642b6f73658132720b5add07920062788ec12e9cf777515dd905d28b69afbb0fc469a5d4437f4fa7ea9a6ffe908f2f34b6d52e071

    Download Submit

  • C:\Windows\SysWOW64\jfvpeyomxivhmxlnad.exe
    Filesize

    556KB

    MD5

    df9f83686c697a68d57f5983d39f52ee

    SHA1

    46ae2d9fa980e492d59f67ed20ab0803c05d81ea

    SHA256

    53bdb5ed28aaac05555364dcc5dafb711d5f1f9d1b1f75b2956db56ba37adc6c

    SHA512

    47a98791bc2ae5555ca31391e4493be27d2f6d7c6be8bbd2f900fa281ba2b9cf447fc9be7ee70c6afb506b3495b0c8264ea508f9a762432ccb6b3b2b23b7f482

    Download Submit

  • C:\anuflwdsu.bat
    Filesize

    532KB

    MD5

    75ee271969b3c52f8d22864bb19c0426

    SHA1

    e2b5e05bc38c0577018f1fc09d8e74cd53624385

    SHA256

    f6acea36ea9f149a8fe12ec7e0493ed312ba46bfc2d655003036df27f161ac23

    SHA512

    6d915173abf243ac909a55f59c0ba3a100eca48a409053e68c34f63e3f663a1282bd6c02cddba338d5fdf90bbf38cbe3db8245ad78e7aca25627b92372bdc02b

    Download Submit