Overview

overview

10

Static

static

3

eeb24a1ba8...18.exe

windows7-x64

10

eeb24a1ba8...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 00:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eeb24a1ba8ac5d382158a0cf6818be1d_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    eeb24a1ba8ac5d382158a0cf6818be1d

  • SHA1

    078dd0c061a3afe3171437d504d2562e9ebd3201

  • SHA256

    2d49431463da6ba1b804807898881ad7695ad705d1ae0eb3c340b64420eb26c0

  • SHA512

    af8b8acbaf670a9dd3d76e35e42f082967a2c50fd4439a98a230625fe18ee78dce67cc957c4847e2f79853f3601b256c97600f661ab83d55871f46b6b2781a41

  • SSDEEP

    384:Rczr6iaVwJpxlyLdvjLCCvetrUJWiaV7r:RelxrojOxrUXI

Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs
    evasion
  • UAC bypass 3 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 5 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Drops file in Drivers directory 10 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
    persistence
  • Executes dropped EXE 20 IoCs
  • Adds Run key to start application 2 TTPs 20 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 30 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • System policy modification 1 TTPs 10 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeb24a1ba8ac5d382158a0cf6818be1d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eeb24a1ba8ac5d382158a0cf6818be1d_JaffaCakes118.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4508
    • C:\Windows\SysWOW64\drivers\csrss.exe
      C:\Windows\System32\drivers\csrss.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2560
      • C:\Windows\SysWOW64\drivers\csrss.exe
        C:\Windows\System32\drivers\csrss.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3468
      • C:\Windows\SysWOW64\Yukime.exe
        C:\Windows\System32\Yukime.exe
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2772
        • C:\Windows\SysWOW64\drivers\csrss.exe
          C:\Windows\System32\drivers\csrss.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3416
        • C:\Windows\SysWOW64\Yukime.exe
          C:\Windows\System32\Yukime.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2652
        • C:\Windows\SysWOW64\Michelle.exe
          C:\Windows\System32\Michelle.exe
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Drops file in Drivers directory
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Enumerates connected drives
          • Modifies WinLogon
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4380
          • C:\Windows\SysWOW64\drivers\csrss.exe
            C:\Windows\System32\drivers\csrss.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2860
          • C:\Windows\SysWOW64\Yukime.exe
            C:\Windows\System32\Yukime.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:368
          • C:\Windows\SysWOW64\Michelle.exe
            C:\Windows\System32\Michelle.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2848
          • C:\Windows\SysWOW64\Ria.exe
            C:\Windows\System32\Ria.exe
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4624
            • C:\Windows\SysWOW64\drivers\csrss.exe
              C:\Windows\System32\drivers\csrss.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2548
            • C:\Windows\SysWOW64\Yukime.exe
              C:\Windows\System32\Yukime.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2996
            • C:\Windows\SysWOW64\Michelle.exe
              C:\Windows\System32\Michelle.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1572
            • C:\Windows\SysWOW64\Ria.exe
              C:\Windows\System32\Ria.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1452
        • C:\Windows\SysWOW64\Ria.exe
          C:\Windows\System32\Ria.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1400
      • C:\Windows\SysWOW64\Michelle.exe
        C:\Windows\System32\Michelle.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5080
      • C:\Windows\SysWOW64\Ria.exe
        C:\Windows\System32\Ria.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4360
    • C:\Windows\SysWOW64\Yukime.exe
      C:\Windows\System32\Yukime.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1996
    • C:\Windows\SysWOW64\Michelle.exe
      C:\Windows\System32\Michelle.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3184
    • C:\Windows\SysWOW64\Ria.exe
      C:\Windows\System32\Ria.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

7
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Yukime.exe
    Filesize

    40KB

    MD5

    eeb24a1ba8ac5d382158a0cf6818be1d

    SHA1

    078dd0c061a3afe3171437d504d2562e9ebd3201

    SHA256

    2d49431463da6ba1b804807898881ad7695ad705d1ae0eb3c340b64420eb26c0

    SHA512

    af8b8acbaf670a9dd3d76e35e42f082967a2c50fd4439a98a230625fe18ee78dce67cc957c4847e2f79853f3601b256c97600f661ab83d55871f46b6b2781a41

    Download Submit