Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 14:34 UTC

General

  • Target

    e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe

  • Size

    453KB

  • MD5

    e062ab8f3a0b6f89be8e142ccf12e109

  • SHA1

    ac23ec726f4b1d6521a087ecbff40d6436ddc355

  • SHA256

    109d2c68ae248842419691db5704822c6f96ec1472c62ecb372d80d55d167408

  • SHA512

    6c3cbf28459d8c746b4a46e522f1e01a5051da996f4e2a8e921663ea3f16afc97ca38ee3b00adda3d5831dc8b4c76dd4c9b72e297fcb587436cb6ed67d2912fb

  • SSDEEP

    12288:AwW9bX6QzUAGS1s15Ap/G/8g3D0Fw/tN8dkmLtpHHHrh702:AhbKWUAGS6j8gz0FmcLbH102

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 54 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -NoProfile -NoLogo -Command "Write-Host ($PSVersionTable.psversion)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3592
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS^|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)^|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)^|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)^|$($_.productState)\"};} Write-Host ($avlist -join \"^*\")}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:812

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    install.theswiftrecord.com
    e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    install.theswiftrecord.com
    IN A
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    install.theswiftrecord.com
    e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    install.theswiftrecord.com
    IN A
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    install.theswiftrecord.com
    e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    install.theswiftrecord.com
    IN A
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    25.140.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    25.140.123.92.in-addr.arpa
    IN PTR
    Response
    25.140.123.92.in-addr.arpa
    IN PTR
    a92-123-140-25deploystaticakamaitechnologiescom
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.173.189.20.in-addr.arpa
    IN PTR
No results found
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    install.theswiftrecord.com
    dns
    e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe
    72 B
    140 B
    1
    1

    DNS Request

    install.theswiftrecord.com

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    68.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    68.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    install.theswiftrecord.com
    dns
    e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe
    72 B
    140 B
    1
    1

    DNS Request

    install.theswiftrecord.com

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    install.theswiftrecord.com
    dns
    e062ab8f3a0b6f89be8e142ccf12e109_JaffaCakes118.exe
    72 B
    140 B
    1
    1

    DNS Request

    install.theswiftrecord.com

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    25.140.123.92.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    25.140.123.92.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    28.173.189.20.in-addr.arpa
    dns
    72 B
    1

    DNS Request

    28.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    4280e36a29fa31c01e4d8b2ba726a0d8

    SHA1

    c485c2c9ce0a99747b18d899b71dfa9a64dabe32

    SHA256

    e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

    SHA512

    494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    16KB

    MD5

    598020af2e6839354bf56fdeac533e5b

    SHA1

    68606c06a7defd388c091fb3bacb25608c05b568

    SHA256

    358707ac13604f167071f3978a8a7d7c5f17ff4d9550f4de60138bf3c1d432bc

    SHA512

    7446649523e4448d8d9107d9fea6d5add98124de94b29eeac1d18ded1195a68de1f576fd5c6a7cce688aa395fa4df285199d43474752e2cf90c5abebc0f6fb2d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbzrazb3.kcm.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\IpConfig.dll

    Filesize

    114KB

    MD5

    a3ed6f7ea493b9644125d494fbf9a1e6

    SHA1

    ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8

    SHA256

    ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08

    SHA512

    7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\NSISEncrypt.dll

    Filesize

    129KB

    MD5

    20c72e4fd54b15d078d00cd67e5b2e03

    SHA1

    11b1221601cb16b4e3f00463582b704914edb9f6

    SHA256

    7aec2cadcfb66a1770d2664deb6cec81c8e24c3b50b8fd49df0ca69bd011e496

    SHA512

    97327358dcab66eccab129f4b467f0faaba02424927169e571dac27d669452d9155e08a9ec60510996307818cb5ede2a1c13e295cab53daa331de7f6e45b2d59

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\WmiInspector.dll

    Filesize

    93KB

    MD5

    cd390387039d7d2928e297b3d23edbc8

    SHA1

    9d6fb8ca71214be21a0a57ed5abdffde71870549

    SHA256

    6a91606c5b6de503e35d30112368ed5fdf30eaeabe0f0ecef8b50b08c4ca1870

    SHA512

    f96711484dd1730c6b1108ec0356aeb3b8f0a3aabe8b13c09ce8c1454dc7b0d64859ac0b8eadedecf8a1a21d43e29576c779625b6571202f7469bf74e1c86483

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\inetc.dll

    Filesize

    20KB

    MD5

    e541458cfe66ef95ffbea40eaaa07289

    SHA1

    caec1233f841ee72004231a3027b13cdeb13274c

    SHA256

    3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420

    SHA512

    0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    acc2b699edfea5bf5aae45aba3a41e96

    SHA1

    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    SHA256

    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    SHA512

    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

  • C:\Users\Admin\AppData\Local\Temp\nsf6080.tmp\nsJSON.dll

    Filesize

    7KB

    MD5

    b9cd1b0fd3af89892348e5cc3108dce7

    SHA1

    f7bc59bf631303facfc970c0da67a73568e1dca6

    SHA256

    49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

    SHA512

    fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

  • memory/812-169-0x0000000007320000-0x00000000073B6000-memory.dmp

    Filesize

    600KB

  • memory/812-173-0x0000000072B90000-0x0000000073340000-memory.dmp

    Filesize

    7.7MB

  • memory/812-158-0x0000000005B60000-0x0000000005EB4000-memory.dmp

    Filesize

    3.3MB

  • memory/812-157-0x0000000072B90000-0x0000000073340000-memory.dmp

    Filesize

    7.7MB

  • memory/812-156-0x0000000072B90000-0x0000000073340000-memory.dmp

    Filesize

    7.7MB

  • memory/812-170-0x00000000072A0000-0x00000000072C2000-memory.dmp

    Filesize

    136KB

  • memory/812-171-0x0000000007970000-0x0000000007F14000-memory.dmp

    Filesize

    5.6MB

  • memory/812-155-0x0000000072B90000-0x0000000073340000-memory.dmp

    Filesize

    7.7MB

  • memory/3592-130-0x0000000005B50000-0x0000000005BB6000-memory.dmp

    Filesize

    408KB

  • memory/3592-142-0x00000000061F0000-0x000000000623C000-memory.dmp

    Filesize

    304KB

  • memory/3592-143-0x0000000007AF0000-0x000000000816A000-memory.dmp

    Filesize

    6.5MB

  • memory/3592-144-0x00000000066B0000-0x00000000066CA000-memory.dmp

    Filesize

    104KB

  • memory/3592-147-0x0000000072B90000-0x0000000073340000-memory.dmp

    Filesize

    7.7MB

  • memory/3592-141-0x00000000061A0000-0x00000000061BE000-memory.dmp

    Filesize

    120KB

  • memory/3592-140-0x0000000005BC0000-0x0000000005F14000-memory.dmp

    Filesize

    3.3MB

  • memory/3592-129-0x0000000005AE0000-0x0000000005B46000-memory.dmp

    Filesize

    408KB

  • memory/3592-128-0x0000000005300000-0x0000000005322000-memory.dmp

    Filesize

    136KB

  • memory/3592-127-0x0000000005380000-0x00000000059A8000-memory.dmp

    Filesize

    6.2MB

  • memory/3592-126-0x0000000072B90000-0x0000000073340000-memory.dmp

    Filesize

    7.7MB

  • memory/3592-125-0x0000000002BC0000-0x0000000002BF6000-memory.dmp

    Filesize

    216KB

  • memory/3592-124-0x0000000072B9E000-0x0000000072B9F000-memory.dmp

    Filesize

    4KB

  • memory/4672-83-0x0000000073450000-0x000000007345A000-memory.dmp

    Filesize

    40KB

  • memory/4672-15-0x00000000030F0000-0x0000000003116000-memory.dmp

    Filesize

    152KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.