Overview

overview

7

Static

static

1

167b2e4547...18.exe

windows7-x64

7

167b2e4547...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 06:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    167b2e4547779a8ab4999dcb139dd6df_JaffaCakes118.exe

  • Size

    7.7MB

  • MD5

    167b2e4547779a8ab4999dcb139dd6df

  • SHA1

    864825ebd2883e9d70a4e5ae27951e96357b060d

  • SHA256

    712dae78fed3260bf1777392dc3ebb5d0eb84db165887098646ed6ba1dea519f

  • SHA512

    8696d9938fe983eb7018bf7b266c29f7e68da1fc32623e3430d29d6c08f522be2917ae3b305f5a31698443527f209d44b6de10771afdea45932c8337eb1f7d27

  • SSDEEP

    196608:q4lVrq9+AzRA/Pob+fK3QKnePsf400h74ZZesa4WGLvzCcy:h20Pi400hkLHa4Webvy

Score
7/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\167b2e4547779a8ab4999dcb139dd6df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\167b2e4547779a8ab4999dcb139dd6df_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\is-D0A20.tmp\167b2e4547779a8ab4999dcb139dd6df_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D0A20.tmp\167b2e4547779a8ab4999dcb139dd6df_JaffaCakes118.tmp" /SL5="$201C4,7710254,334336,C:\Users\Admin\AppData\Local\Temp\167b2e4547779a8ab4999dcb139dd6df_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Program Files (x86)\KuGou\KuGou2010\KuGoo.exe
        "C:\Program Files (x86)\KuGou\KuGou2010\KuGoo.exe" Import
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:1732
      • C:\Windows\SysWOW64\regsvr32.exe
        "regsvr32" /s "C:\Windows\system32\KuGoo3DownXControl.ocx"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1980
      • C:\Program Files (x86)\KuGou\KuGou2010\KuGoo.exe
        "C:\Program Files (x86)\KuGou\KuGou2010\KuGoo.exe" RegFileType
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\KuGou\KuGou2010\config.ini
    Filesize

    249B

    MD5

    97aac1eb208860c383828687a58a82fa

    SHA1

    8511af1cd6f580bdedb17eda7c72037ab8ea3b7d

    SHA256

    7773be3ec1b30fa614693f36942030d5beb75b845930ed90e77e68f2b0ffb9f7

    SHA512

    98063587d8bc6c91340ae612a52cf529ad4b26c23123adb3a921e65a97e6fcded68023dd000d7eeb2f1849ec4b9f1758d577dd4267436c18e1ae0a478afcfe2a

    Download Submit

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\¿á¹·ÒôÀÖ\¿á¹·ÒôÀÖ2010\¿á¹·ÒôÀÖ2010.lnk
    Filesize

    1KB

    MD5

    1c6e87b00a7ef367854b538b42d95589

    SHA1

    944b26334a544c777b07a52c074e15549cf925ea

    SHA256

    4dbfd9d774d82a85019a40656fe2e7b2abf62dc36acf38996b36afd95d1bc430

    SHA512

    ccdd33c610a29e672e0ede750f31df315e0ab77fde51e18afd37455614d56516900fc1e47442ad37c6b7fcbf97b2ad9714dd9e2ea53b2562024e24fe26eed619

    Download Submit

  • C:\Windows\SysWOW64\KuGoo3DownXControl.ocx
    Filesize

    535KB

    MD5

    432ea1d34edf34e3b0549b7fe4293e2c

    SHA1

    d107a931602a8cbcd0dd7d879dc4846691740858

    SHA256

    6898cd6cd21b08f2d8bab36aeb0394c752ba23db8332d59be9071c86ab06ca7f

    SHA512

    8066fc1784bb3304015656ae8c82be236acdef3b254f0ceab33631b9648699b5c04ed256e3c46bf3d3a0236b5e1d85fb0966ebf647ab25475dd163c0e3baecc7

    Download Submit

  • \Program Files (x86)\KuGou\KuGou2010\KuGoo.exe
    Filesize

    4.8MB

    MD5

    5eb1f1ea02d9dd70c4108be67ac93cfb

    SHA1

    0656c05633ed2a52fe53089a935ea2224a32d550

    SHA256

    23fb9c2930c687ee1cf6d611e35a2e7858bc7dbef2cfaf06bf7676f7927d711f

    SHA512

    73a9aada0fe360b4e10afb3f4fa7a042c04e5070c1a93bc62da5ed970f0333f8900bdcae0f9124ccc6131a6bee4452aaf78cc8c4cc6c5d17263a455fe1c66392

    Download Submit

  • \Program Files (x86)\KuGou\KuGou2010\unins000.exe
    Filesize

    891KB

    MD5

    52911d4ca25ef5170fceb807f9062114

    SHA1

    c5faa594b9e1b12e77ae37fac92273da88c45e03

    SHA256

    ac70435905cbb8cca3c261cf7d27f0e077926385012e97150e3f4f08a6fe06e3

    SHA512

    e538ac87c1760e6f4db5bb7a81d0c2a00ed937f6093be916f64200b4163cd4d1d73253c2b0fa8e4e88d12df2614ccd63a274695f2ee5321364c2e17c15ca4e7e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-637OC.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-637OC.tmp\isx.dll
    Filesize

    205KB

    MD5

    96d2c45b7ab03356d612e4606d23f196

    SHA1

    f9fa646c66b4b792d5e5f632cc515030acc80a9e

    SHA256

    f82e0e6830b0232634aa983a2e0c27c77dbf8599b0a1bf919a37ad0eb531e54d

    SHA512

    cff01cab7ad35c743f5384cd83a293f02c66798cf9a675939874ae3ae5c3cd97455423a80590dd011b7e2d1258aed7402f033e003119203484c56c2d58062f12

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-D0A20.tmp\167b2e4547779a8ab4999dcb139dd6df_JaffaCakes118.tmp
    Filesize

    885KB

    MD5

    be74f275a12b6648cce33a9fe3d44bbe

    SHA1

    8d12bdd409cd1e4ea76fd71448b70b81edda2bdb

    SHA256

    11fc2eb509c35eaabaad33463e95ad17beea602e4707170b9e1ad52f07a4e790

    SHA512

    6492ee751e897e54408db7c54cf178d71ab3732c965853c858420ac771cfda0f4ef76eb949e5d69f8a55464bb1e54e38aba91d33c769cf419eb42b1b138f749d

    Download Submit

  • memory/928-220-0x0000000000400000-0x00000000008ED000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/1716-10-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB

    Download

  • memory/1716-20-0x0000000001FC0000-0x0000000001FFD000-memory.dmp

    Filesize

    244KB

    Download

  • memory/1716-230-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB

    Download

  • memory/1732-201-0x0000000000400000-0x00000000008ED000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/1980-204-0x0000000000610000-0x000000000069E000-memory.dmp

    Filesize

    568KB

    Download

  • memory/2108-3-0x0000000000401000-0x0000000000444000-memory.dmp

    Filesize

    268KB

    Download

  • memory/2108-1-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

    Download

  • memory/2108-0-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2108-231-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

    Download