965a815b8988ceefe839e145b24db60937b61d3936245cd76a6731d1d6f7ad36

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
Size

280KB
MD5

e201035da540f907e7e6b1f5014b8b32
SHA1

bd78fb5a2acf43cff073639e3e16f23c892e6bd7
SHA256

965a815b8988ceefe839e145b24db60937b61d3936245cd76a6731d1d6f7ad36
SHA512

d385b2a2c2a9a5e7db822dd7d4d1456fe95c1f758852d314e58160bfd557829066ed29aacedf575e51a35778ce9a0cc5b6543ef47ea04e45d0447b8a4897c1e7
SSDEEP

6144:iwXjAbXkekuAtw9xvvfSANYL7wG0L2QiW:iwXjAbXkhfcvUI2S

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2892	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2340	qyop.exe
2100	qyop.exe

Loads dropped DLL 3 IoCs

pid	Process
2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
2340	qyop.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\{4E9C0C8D-18D9-A445-6B93-1883F270CD0E} = "C:\\Users\\Admin\\AppData\\Roaming\\Axgoki\\qyop.exe"	qyop.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2340 set thread context of 2100	2340	qyop.exe	32

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qyop.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe
2100	qyop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
2340	qyop.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2192	2440	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2340	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2340	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2340	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2340	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	31
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2340 wrote to memory of 2100	2340	qyop.exe	32
PID 2192 wrote to memory of 2892	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2892	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2892	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2892	2192	e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe	33
PID 2100 wrote to memory of 1112	2100	qyop.exe	19
PID 2100 wrote to memory of 1112	2100	qyop.exe	19
PID 2100 wrote to memory of 1112	2100	qyop.exe	19
PID 2100 wrote to memory of 1112	2100	qyop.exe	19
PID 2100 wrote to memory of 1112	2100	qyop.exe	19
PID 2100 wrote to memory of 1164	2100	qyop.exe	20
PID 2100 wrote to memory of 1164	2100	qyop.exe	20
PID 2100 wrote to memory of 1164	2100	qyop.exe	20
PID 2100 wrote to memory of 1164	2100	qyop.exe	20
PID 2100 wrote to memory of 1164	2100	qyop.exe	20
PID 2100 wrote to memory of 1232	2100	qyop.exe	21
PID 2100 wrote to memory of 1232	2100	qyop.exe	21
PID 2100 wrote to memory of 1232	2100	qyop.exe	21
PID 2100 wrote to memory of 1232	2100	qyop.exe	21
PID 2100 wrote to memory of 1232	2100	qyop.exe	21
PID 2100 wrote to memory of 632	2100	qyop.exe	25
PID 2100 wrote to memory of 632	2100	qyop.exe	25
PID 2100 wrote to memory of 632	2100	qyop.exe	25
PID 2100 wrote to memory of 632	2100	qyop.exe	25
PID 2100 wrote to memory of 632	2100	qyop.exe	25
PID 2100 wrote to memory of 2892	2100	qyop.exe	33
PID 2100 wrote to memory of 2892	2100	qyop.exe	33
PID 2100 wrote to memory of 2892	2100	qyop.exe	33
PID 2100 wrote to memory of 2892	2100	qyop.exe	33
PID 2100 wrote to memory of 2892	2100	qyop.exe	33
PID 2100 wrote to memory of 2940	2100	qyop.exe	36
PID 2100 wrote to memory of 2940	2100	qyop.exe	36
PID 2100 wrote to memory of 2940	2100	qyop.exe	36
PID 2100 wrote to memory of 2940	2100	qyop.exe	36
PID 2100 wrote to memory of 2940	2100	qyop.exe	36
PID 2100 wrote to memory of 2604	2100	qyop.exe	37
PID 2100 wrote to memory of 2604	2100	qyop.exe	37
PID 2100 wrote to memory of 2604	2100	qyop.exe	37
PID 2100 wrote to memory of 2604	2100	qyop.exe	37
PID 2100 wrote to memory of 2604	2100	qyop.exe	37

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e201035da540f907e7e6b1f5014b8b32_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Users\Admin\AppData\Roaming\Axgoki\qyop.exe
      "C:\Users\Admin\AppData\Roaming\Axgoki\qyop.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\Users\Admin\AppData\Roaming\Axgoki\qyop.exe
        
        "C:\Users\Admin\AppData\Roaming\Axgoki\qyop.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa66f0f06.bat"
      4⤵
      Deletes itself
      System Location Discovery: System Language Discovery
      PID:2892

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:632

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2940

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpa66f0f06.bat

Filesize
271B

MD5
6f7867d773e3785647baf322e14eb500

SHA1
a37779feb745faa19e27eb15696761c14c59af71

SHA256
54fe8b730fa2db69cf69ef8bc308d4cfaa3979475e94c8cf4ae94ea049ecc80c

SHA512
1ab30bdd850d57daf18178511dc1fb297c81a6c27b0bfc6488139757170d145640472a184218ff09d20069af3e436d308fca364dc47a7befa519cefca73bc619

Download Submit
\Users\Admin\AppData\Roaming\Axgoki\qyop.exe

Filesize
280KB

MD5
081285d975eeee6af0fcdc200be7d52a

SHA1
c9936600ac1356583c04cd30b31fdb8a7a8dc985

SHA256
31b97abbd8862f697cb5e93e68acdae708cf0c6af03da9c8d598589a7945b0dd

SHA512
1c5530c89ec913ba3171a79eb56b8103a879a5da18f6e997a7bc0ee62ff5f68398a1e63e1f84beeb03fe6af700e2d7ca5029bf9ba27d3add69a3933748bac81a

Download Submit
memory/632-71-0x0000000001D30000-0x0000000001D57000-memory.dmp

Filesize
156KB

Download
memory/632-72-0x0000000001D30000-0x0000000001D57000-memory.dmp

Filesize
156KB

Download
memory/632-73-0x0000000001D30000-0x0000000001D57000-memory.dmp

Filesize
156KB

Download
memory/632-74-0x0000000001D30000-0x0000000001D57000-memory.dmp

Filesize
156KB

Download
memory/1112-51-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/1112-52-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/1112-53-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/1112-54-0x0000000002220000-0x0000000002247000-memory.dmp

Filesize
156KB

Download
memory/1164-59-0x00000000001B0000-0x00000000001D7000-memory.dmp

Filesize
156KB

Download
memory/1164-57-0x00000000001B0000-0x00000000001D7000-memory.dmp

Filesize
156KB

Download
memory/1164-61-0x00000000001B0000-0x00000000001D7000-memory.dmp

Filesize
156KB

Download
memory/1164-63-0x00000000001B0000-0x00000000001D7000-memory.dmp

Filesize
156KB

Download
memory/1232-68-0x0000000002A80000-0x0000000002AA7000-memory.dmp

Filesize
156KB

Download
memory/1232-66-0x0000000002A80000-0x0000000002AA7000-memory.dmp

Filesize
156KB

Download
memory/1232-67-0x0000000002A80000-0x0000000002AA7000-memory.dmp

Filesize
156KB

Download
memory/1232-69-0x0000000002A80000-0x0000000002AA7000-memory.dmp

Filesize
156KB

Download
memory/2100-96-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2100-84-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2100-83-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2100-46-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-17-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-16-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-15-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-49-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2892-77-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/2892-76-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/2892-78-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/2892-79-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/2892-80-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download