Overview

overview

10

Static

static

3

2afc84a5a7...18.exe

windows7-x64

10

2afc84a5a7...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 04:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2afc84a5a79d5f773f6333d11fe6c72d_JaffaCakes118.exe

  • Size

    472KB

  • MD5

    2afc84a5a79d5f773f6333d11fe6c72d

  • SHA1

    c0d800b008dfbe06516edfb2c138651a21a48909

  • SHA256

    e753843b9b89738a7dc192a7566e0e595981b48f3054d947cf8cb81390679027

  • SHA512

    0a818e71292c2bec71368faf354c5a7c0a41f03c9cc3b3562b389d2b33bf1abd2aea6875f7a311872f327ebc10559bb08f705d77add8960dd7ee6c1215b8a46e

  • SSDEEP

    12288:i6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLg1+:zvdezCByqTtlMQsFuqzRbzI7IB

Score
10/10
defense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • UAC bypass 3 TTPs 13 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 30 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 38 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2afc84a5a79d5f773f6333d11fe6c72d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2afc84a5a79d5f773f6333d11fe6c72d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe
      "C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe" "c:\users\admin\appdata\local\temp\2afc84a5a79d5f773f6333d11fe6c72d_jaffacakes118.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:732
      • C:\Users\Admin\AppData\Local\Temp\dfgqu.exe
        "C:\Users\Admin\AppData\Local\Temp\dfgqu.exe" "-C:\Users\Admin\AppData\Local\Temp\anzujznhvhjjufac.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:1520
      • C:\Users\Admin\AppData\Local\Temp\dfgqu.exe
        "C:\Users\Admin\AppData\Local\Temp\dfgqu.exe" "-C:\Users\Admin\AppData\Local\Temp\anzujznhvhjjufac.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2328
    • C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe
      "C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe" "c:\users\admin\appdata\local\temp\2afc84a5a79d5f773f6333d11fe6c72d_jaffacakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:3392

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Replication Through Removable Media

        1
        T1091

        Execution

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Hijack Execution Flow

        1
        T1574

        Executable Installer File Permissions Weakness

        1
        T1574.005

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Hijack Execution Flow

        1
        T1574

        Executable Installer File Permissions Weakness

        1
        T1574.005

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Hijack Execution Flow

        1
        T1574

        Executable Installer File Permissions Weakness

        1
        T1574.005

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Safe Mode Boot

        1
        T1562.009

        Modify Registry

        5
        T1112

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Replication Through Removable Media

        1
        T1091

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          17131ae30e8d91483291bbf30a21c5d3

          SHA1

          5f4f1b30dbb28f662960bcaff4e95a5a48e0fcd2

          SHA256

          90236d4d72d9b5c2d1761395b782ca08aec3954e9f7ff9ceadd39547d2893fdf

          SHA512

          cf06abff3046f0119bc6672179c9b2bc9ec518807c65d40382e8abfb0360857159fc9266740fcdbf142e7e22baa873b278fa87fb45b48d487fc9f1ffcc0d6dbe

          Download Submit

        • C:\Program Files (x86)\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          32866fd29b395f6ae27085edb1861991

          SHA1

          ac18eedde411a25e5889624bf44457d926da79be

          SHA256

          6938d0d06f86f8646d4f2551049d79d73f2f8203bc723dad2f7739c0b8245867

          SHA512

          d7755e18147d98f006880e999e3d329b3c66106f4fbd4a9f75a5e3dc06da3336eb50761757284c5825ae9dc35e26528ebdf3d5087f713007ac913d77534ec15a

          Download Submit

        • C:\Program Files (x86)\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          f4bf6f41cd8c030385ad81af99507604

          SHA1

          463dece117958f556bac399c3e77c66e8e26649b

          SHA256

          9b117475f84aaa49628b35e638c183db065e60bdc5672858224189695824c069

          SHA512

          7c4c09ce41afaab4d5af98f9ac2d2517a1614d7a8141328213ddc11256a05028bc0bd5f9568089f774c3bd29168f8c212a8d825924e261e7dfb64df0ebd83c72

          Download Submit

        • C:\Program Files (x86)\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          0a69a0f0266a0ad461e22ef6febfbcc3

          SHA1

          7c67ccc3a9ccb19abf545287f581a0a35f42b207

          SHA256

          2761cc7bd2177e24e1ebaaa04d0a5f696183c1dd9e656033b2775a9f60a748b4

          SHA512

          d474dfb47260787fafd6fc6a83ac3baff316a02c0725f354208bc141977107f6919f847995d91c721aed374392bac63030d9b08c34a9b3a3bff9e5bdfcdd586c

          Download Submit

        • C:\Program Files (x86)\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          ad63b522c708ac2de87eb07499bc1c09

          SHA1

          ae0fb87e5302f046e6fcabeb5286f2fb33a5c14e

          SHA256

          98cb949540fef1e5bbca1bf1691837bc30b16957aa0c2d2825a49f177e194345

          SHA512

          5d5afaf40253875dc9f9717a14f35207a87a987648946b0a24b64134e4338ab6097cb9770df75e2ec32dc06eb7c942526bd12e090f0eafe146b68d121b8124a4

          Download Submit

        • C:\Program Files (x86)\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          2c5df27696dc32e22393f9ebdb926259

          SHA1

          cda86b2ea3fd0dee645c2047a99c648370236e1d

          SHA256

          12b9609e8aa49fa354fccc01cdcf8b7ff638cfd5ced835139d69181584a332d7

          SHA512

          0933c6c128c25ade666114cb903cc7966489525b8ec2e9f63ff89b73d40389fe2a5d6a64b906c648650b14adc3eb6d5b110d3d8c2d9f51b09a431b4931b96004

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe
          Filesize

          320KB

          MD5

          89ec3461ef4a893428c32f89de78b396

          SHA1

          8067cdc0901f0dc5bc1bb67a1c9037f502ea85f9

          SHA256

          1849989ee704cda3b552b5021f3165012978d26d0daf7d22a09805deb6be2d0b

          SHA512

          7804fa36e1f050115b00d21a9a94cf92436260a385da67106b0c73eb350abafca53f2dec42d377d4eccc095dd75ac92e841fb66e874e656e412cd71ed7909fe8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\dfgqu.exe
          Filesize

          704KB

          MD5

          c2bc548487fe0acd841b387c3863ffce

          SHA1

          55fd452029b4f83737eb3f83d0837f5d32dbc7db

          SHA256

          a0011f1ff42110fa6a44996fa38de23371ac0a85e4a472f68b96d5482db2d35a

          SHA512

          b9c110b03b03299d0e87d139379143130472e68929cf3a8bd9ddd1461bdeaa91e6f9ab4cddefb2dae018f4f5bee8266b9210426e3389827f195df2831b35d7d9

          Download Submit

        • C:\Users\Admin\AppData\Local\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          7fb2ff812abe0253e1efd85c0a421148

          SHA1

          5a35fc258ed4de4a9118578422da0cf7fc8680ef

          SHA256

          2fc87194d9ac110dd857ced5a95747763f59e79e016f5aa82ae5f171db757900

          SHA512

          5119a9cc71943579d9a7975f501e04282bfb06c004424a8a11e45048997fe40ab3d08358559b34debfa9a96d42a5434c46f3d9e5bf3edb9da49b40246b6f632b

          Download Submit

        • C:\Users\Admin\AppData\Local\nnmuwzahihwjhfncycppowybc.kjy
          Filesize

          272B

          MD5

          c54a5efd8d7193be98c3b592469a4d02

          SHA1

          df8048e3191bc11e0a05a1a79e3d59ce66f78807

          SHA256

          2e8ef0c0dd387510a13b3bbe2ce018bca2ee4e48d215d95df19622249aaa6498

          SHA512

          71e61e5b120add94d89a1e4708a28ad831d9af8f4b91829a259374c2461e40678a44c820b16829531b75f22b5a6db22b410ce703bd3f3ecf7e85ff490cfbc6f2

          Download Submit

        • C:\Users\Admin\AppData\Local\sdngthtlxhhfoxqqxmkvfylzldpzzxgpiipe.nxq
          Filesize

          3KB

          MD5

          77e23c145b60d1064e1e69c5080de798

          SHA1

          2eff323a3e72e1c41390d3f17ddeea59ca353f35

          SHA256

          7c6b2750e6930cce122039b6521170a7d045c4ecabaadd4e051d414f6c169d1f

          SHA512

          5ee81fa01f08ff8c711bdfa258eab92d0654a24abab963b74ff12bbe444e33432cbcfa4f3d88ab7d163365e99ec1e22ab1d4d7f0c06c867a3a96152527faaa0c

          Download Submit

        • C:\Windows\SysWOW64\qftqhzplbptvivswha.exe
          Filesize

          472KB

          MD5

          2afc84a5a79d5f773f6333d11fe6c72d

          SHA1

          c0d800b008dfbe06516edfb2c138651a21a48909

          SHA256

          e753843b9b89738a7dc192a7566e0e595981b48f3054d947cf8cb81390679027

          SHA512

          0a818e71292c2bec71368faf354c5a7c0a41f03c9cc3b3562b389d2b33bf1abd2aea6875f7a311872f327ebc10559bb08f705d77add8960dd7ee6c1215b8a46e

          Download Submit