fdbb53bea57607a065cca4eeb7b55f8678e5b21600497492ec67d0fc7926d985

Analysis

max time kernel
90s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe
Size

214KB
MD5

fdf5cf61ae16a8491d38de55ecc19fc0
SHA1

e3388050515d51b41616297fc5bb213f0658ccc5
SHA256

fdbb53bea57607a065cca4eeb7b55f8678e5b21600497492ec67d0fc7926d985
SHA512

38f2c18f696be69f08331e4aa507108528be4d0232586e919910c3cc80654ba926c1f24903258764cb1b6f6fdcc5d661245e9482fce043139e36a8481a10749d
SSDEEP

3072:6/uSnUuEgbB3cTlji/6/nZ0f/2GS1c5mk16bzpqZsK8Lm6Zp:CbB3j/6y3xJ8k1kzmsK8L9Zp

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4884	HelpMe.exe
2552	shell.exe

Drops autorun.inf file 1 TTPs 48 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\v:\autorun.inf	HelpMe.exe
File created	\??\y:\autorun.inf	HelpMe.exe
File created	\??\f:\autorun.inf	HelpMe.exe
File created	\??\i:\autorun.inf	HelpMe.exe
File opened for modification	\??\m:\autorun.inf	HelpMe.exe
File created	\??\q:\autorun.inf	HelpMe.exe
File created	\??\s:\autorun.inf	HelpMe.exe
File opened for modification	\??\s:\autorun.inf	HelpMe.exe
File created	\??\v:\autorun.inf	HelpMe.exe
File created	\??\w:\autorun.inf	HelpMe.exe
File opened for modification	\??\g:\autorun.inf	HelpMe.exe
File opened for modification	\??\l:\autorun.inf	HelpMe.exe
File created	\??\p:\autorun.inf	HelpMe.exe
File opened for modification	\??\p:\autorun.inf	HelpMe.exe
File created	\??\r:\autorun.inf	HelpMe.exe
File opened for modification	\??\u:\autorun.inf	HelpMe.exe
File created	\??\d:\autorun.inf	HelpMe.exe
File created	\??\g:\autorun.inf	HelpMe.exe
File created	\??\h:\autorun.inf	HelpMe.exe
File opened for modification	\??\k:\autorun.inf	HelpMe.exe
File opened for modification	\??\w:\autorun.inf	HelpMe.exe
File created	\??\x:\autorun.inf	HelpMe.exe
File opened for modification	\??\d:\autorun.inf	HelpMe.exe
File opened for modification	\??\q:\autorun.inf	HelpMe.exe
File opened for modification	\??\x:\autorun.inf	HelpMe.exe
File opened for modification	\??\y:\autorun.inf	HelpMe.exe
File opened for modification	\??\c:\autorun.inf	HelpMe.exe
File opened for modification	\??\e:\autorun.inf	HelpMe.exe
File opened for modification	\??\f:\autorun.inf	HelpMe.exe
File created	\??\l:\autorun.inf	HelpMe.exe
File opened for modification	\??\t:\autorun.inf	HelpMe.exe
File created	\??\u:\autorun.inf	HelpMe.exe
File created	\??\e:\autorun.inf	HelpMe.exe
File opened for modification	\??\j:\autorun.inf	HelpMe.exe
File created	\??\m:\autorun.inf	HelpMe.exe
File opened for modification	\??\o:\autorun.inf	HelpMe.exe
File opened for modification	\??\z:\autorun.inf	HelpMe.exe
File opened for modification	\??\n:\autorun.inf	HelpMe.exe
File opened for modification	\??\r:\autorun.inf	HelpMe.exe
File created	\??\c:\autorun.inf	HelpMe.exe
File opened for modification	\??\h:\autorun.inf	HelpMe.exe
File opened for modification	\??\i:\autorun.inf	HelpMe.exe
File created	\??\j:\autorun.inf	HelpMe.exe
File created	\??\k:\autorun.inf	HelpMe.exe
File created	\??\n:\autorun.inf	HelpMe.exe
File created	\??\t:\autorun.inf	HelpMe.exe
File created	\??\o:\autorun.inf	HelpMe.exe
File created	\??\z:\autorun.inf	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023486-7.dat	upx
behavioral2/memory/4884-8-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4884-29-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	2552	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
388	fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe
4884	HelpMe.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 4884	388	fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe	83
PID 388 wrote to memory of 4884	388	fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe	83
PID 388 wrote to memory of 4884	388	fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe	83
PID 4884 wrote to memory of 2552	4884	HelpMe.exe	84
PID 4884 wrote to memory of 2552	4884	HelpMe.exe	84
PID 4884 wrote to memory of 2552	4884	HelpMe.exe	84

C:\Users\Admin\AppData\Local\Temp\fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdf5cf61ae16a8491d38de55ecc19fc0_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - \??\c:\shell.exe
    c:\shell.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 296
      4⤵
      Program crash
      PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2552 -ip 2552
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\HelpMe.exe

Filesize
90KB

MD5
12412614862087bf9a7920eb7b0ba4bb

SHA1
beadbeb477126ff284eb3b5b2d5d9e2e61e20eda

SHA256
1a22cec2c0eb5b0ee14a499ecc0862f44e0b2fa9f3d9caddd1f51344c6310525

SHA512
35828cb0731f1277063a2dfa663a12807c301c0fef6aa3c0c6b61b71800c4f71e6356640f1adcebce842965d5139181450d7eddc19d6f284fe7c1bd4e4b560d5

Download Submit
C:\shell.exe

Filesize
8KB

MD5
49e4ae66e3d8431281d63042eb2ba526

SHA1
52332e5af72945f86864c3035337288164d83c4d

SHA256
99741cb43cd7404aa00e59e0bad91c2da27d52fb91880a92604e075b71e39985

SHA512
5dc759bbf947de53cac80741725f1be2c127d6c9edcf0ad928f15c2b98417898550af23034447824bacb96ceb4fe672cebf0cfe5e70ef10371ddae2bf93f021e

Download Submit
memory/2552-28-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4884-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4884-29-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads