Overview

overview

7

Static

static

3

f9e84684ca...18.exe

windows7-x64

7

f9e84684ca...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 06:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9e84684ca6f79d20ba858fec3a6482a_JaffaCakes118.exe

  • Size

    8.7MB

  • MD5

    f9e84684ca6f79d20ba858fec3a6482a

  • SHA1

    c4730b2ecf0e0c6036561411c6271dc02bb222d0

  • SHA256

    701b7caaea15c8b8143289789b8e8c60927d72beb0ae2993ade15db62c9e4f5f

  • SHA512

    5c46824d2f135e3b7993aacfc0e145581fbafa73e91acc16eace341693ac5a18b1c60cfd95cc1639da7d543410450290f0a385955d52836e6e6dd262cc433774

  • SSDEEP

    196608:ZdJVXbACSigYoWjL6xzQWvXF8xhls3QcWDTZ9OBCscEIAmhsRBB:ZdzXbACSigYo7B8xh3ZDTZhsTIAt

Score
7/10
discoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 50 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9e84684ca6f79d20ba858fec3a6482a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f9e84684ca6f79d20ba858fec3a6482a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Allok Video Joiner.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Allok Video Joiner.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Users\Admin\AppData\Local\Temp\is-MR8M3.tmp\Allok Video Joiner.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-MR8M3.tmp\Allok Video Joiner.tmp" /SL5="$E025E,8706323,58880,C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Allok Video Joiner.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2508
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\AVEQT.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2860
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\AVERM.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2104
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
    1⤵
      PID:2096

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Allok Video Joiner\Allok Video Joiner.exe
      Filesize

      440KB

      MD5

      897794490e8af876d78a25aeff678408

      SHA1

      9a569a63eba091e74a87c5f0ac9633f3fe9002f6

      SHA256

      0c334f64dec2a7b8710aa6b4cf6ab40b554e0f3e3803493bc475993854023fa4

      SHA512

      63309e2ccd94aead4fbd114626f7f4edb7f70879418589208dd49cee50d5b0eb79579e2ba27739e0af4bc0f2451c534d08ea364d6d937da62faa03ffdcbd4ab5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Allok Video Joiner.exe
      Filesize

      8.5MB

      MD5

      c0e14a9c41cbf979acb4f9d7c4c5411e

      SHA1

      00c0b2ff93d0f4bec3ed3146eb70e6b53e34a742

      SHA256

      1f6b20215795d9eb7a18abc37c4a815123d50ac85a0a054d53f30d56c924301a

      SHA512

      4f85bb277beffb49625b85a872ad7d85be19f20033b1b383c8b204536bda3fba252ab18ddf135eb0e19e753f7a0d63d4c0130ad0817b583685147c90635697bf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-MR8M3.tmp\Allok Video Joiner.tmp
      Filesize

      685KB

      MD5

      b87606f9e0ab4dafa086d13a2e756242

      SHA1

      01b7aefee78bbc2aa4ae57a15b00b6c661195c81

      SHA256

      c288150c6e89d69f4074f93965563a0cdaa719fa13c0613cea744ad1dc833a6f

      SHA512

      a64cf4ad27398cc3e3baa2bcb956359941557d5bffdf0a793eff6091ad46b10cd4200be18ff38b24049f34fc1e93d0e121ff463866217ae5ba9d5feca0f44202

      Download Submit

    • C:\Windows\SysWOW64\AVEQT.dll
      Filesize

      28KB

      MD5

      23b8b59396a50388cd34ceee55a103ee

      SHA1

      41dfcc8f7b388eb456722832200aeb02a9f5c607

      SHA256

      b296f482a598fd83a59a65212aaeb99a2e007853773155b79dc473890186eb3d

      SHA512

      518f120cf217cf1f554eff6ff9174e896c2ca1efa910efa06a01aded5edc59add383ea6dd017d8e798b2bc28b93174db5218dd373739f3ffac05393a53a18832

      Download Submit

    • C:\Windows\SysWOW64\AVERM.dll
      Filesize

      126KB

      MD5

      dc657cc8c152c77f22dbe14c7b96374d

      SHA1

      354c04376bffc07794e1f6a64d2db2df86f73561

      SHA256

      c58b812b7f688ca96adc65fd74281ddad9682417509280bb0f65b9c091d0908c

      SHA512

      89bf1cfe45b0d5848194f85fd52d4910c7cd9afff4b9a695b98a00053a9669f8a3668e0178b7ee1657f81c07bab495e5a41344e53b2aa3127c0160a1d3fe8659

      Download Submit

    • memory/652-12-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

      Download

    • memory/652-14-0x0000000000401000-0x000000000040B000-memory.dmp

      Filesize

      40KB

      Download

    • memory/652-202-0x0000000000400000-0x0000000000415000-memory.dmp

      Filesize

      84KB

      Download

    • memory/2104-195-0x0000000010000000-0x0000000010053000-memory.dmp

      Filesize

      332KB

      Download

    • memory/2508-22-0x0000000000400000-0x00000000004BC000-memory.dmp

      Filesize

      752KB

      Download

    • memory/2508-201-0x0000000000400000-0x00000000004BC000-memory.dmp

      Filesize

      752KB

      Download

    • memory/2860-192-0x0000000010000000-0x0000000010018000-memory.dmp

      Filesize

      96KB

      Download