d5c99d6cab73d6d4fe837adcaabfd38b32f7bdea37546b86d3336aac3d8a1f60

Analysis

max time kernel
127s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe
Size

932KB
MD5

39ce57a07b5dfc971c3ce0d76a9f70a3
SHA1

3b3f8f7466d0a199f45ac418042646d1927864d3
SHA256

d5c99d6cab73d6d4fe837adcaabfd38b32f7bdea37546b86d3336aac3d8a1f60
SHA512

a8529f2b260af96f0e3b5a6a6e61c10eeae6276442856027df745f21433b02b84d75991cfd3127687022e6c984f43aa67fb0a133eb512e7370d7383fde4e84ad
SSDEEP

12288:mQ9fTnBt6urJQ34Lp05r7r5Tck0B6TYNYuPp9B97ucc6n0iXi0nxmhFL6r5cHG92:7nTNQ34L+Tck0BGKhhc65xcFS5cHeOcQ

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	TeamViewer_.exe

Executes dropped EXE 2 IoCs

pid	Process
3748	TeamViewer_.exe
100	TeamViewer.exe

Loads dropped DLL 6 IoCs

pid	Process
3748	TeamViewer_.exe
3748	TeamViewer_.exe
3748	TeamViewer_.exe
3748	TeamViewer_.exe
3748	TeamViewer_.exe
100	TeamViewer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2624-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0007000000023c8b-5.dat	upx
behavioral2/memory/3748-8-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral2/memory/2624-11-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3748-55-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QS\SAS.exe	TeamViewer.exe
File opened for modification	C:\Program Files (x86)\QS\SAS.exe	TeamViewer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3748	2624	39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe	85
PID 2624 wrote to memory of 3748	2624	39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe	85
PID 2624 wrote to memory of 3748	2624	39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe	85
PID 3748 wrote to memory of 100	3748	TeamViewer_.exe	87
PID 3748 wrote to memory of 100	3748	TeamViewer_.exe	87
PID 3748 wrote to memory of 100	3748	TeamViewer_.exe	87

C:\Users\Admin\AppData\Local\Temp\39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39ce57a07b5dfc971c3ce0d76a9f70a3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\temp\TeamViewer3\TeamViewer_.exe
  "C:\Users\Admin\temp\TeamViewer3\TeamViewer_.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Users\Admin\temp\TeamViewer3\TeamViewer.exe
    "C:\Users\Admin\temp\TeamViewer3\TeamViewer.exe" --qsc --pw "Lerchenberg"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc980B.tmp\GetVersion.dll

Filesize
5KB

MD5
c6910d6e78c2e5f9d57d0bc6d8f6b736

SHA1
a395099062298b3f3c015359b227ca02a72c6e2c

SHA256
b2c32af2b0d75dfd08ae4e1ad7c5897957240b32bf7a16855d6a46512d272b9b

SHA512
4cd45b887ce5b7fecfd863cae83817465d7378cc9f5b50f5762d5f209c55a37257d94e91dea4c91c66f2c5bf22cdc1f5545eeef52a090f05cceeedf59bbd2a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc980B.tmp\System.dll

Filesize
10KB

MD5
cfbae93f361e2b430743e423709a483f

SHA1
9d31546592a9e6817025cc5026fee769e9a6c015

SHA256
0f4aac375087f0a5df393d7463bd462193008922136a2aba8619736223ba7add

SHA512
485bc9c83087a1a6f48a5508ee390384c2db93b9d50c295280337dad78b47f65aaa0caea8d6d23ef25f86b73cd2e724cb88a738f6b53037e47225c6522f912b3

Download Submit
C:\Users\Admin\temp\TeamViewer3\SAS.exe

Filesize
53KB

MD5
bf3bcd752bdabfa1f1e84b7462738103

SHA1
34cb8ea7d47467cace271e03b7869f37b0ecb30a

SHA256
90fe790e189c384f2ab82958057f91fdf40888c2ed3c0471bd7b85d5b36c7810

SHA512
6d5362c4d354319845f4522e0d1132c32a6779efc4c013c8c7bd489fddf39cbb5dfb72b135487b660d156d7774e5be4acc03c3fcecdb6dabcfad12630a3f5955

Download Submit
C:\Users\Admin\temp\TeamViewer3\TeamViewer.exe

Filesize
2.3MB

MD5
6e1618f999e32fef59e16b0806b71af9

SHA1
c429f254240e7a67a7c2af82df07c9de0ab125d7

SHA256
c552471c74f7365526877c53268c829ff52f8b3d6e56e655f72cb23dbe4b601d

SHA512
5127032eedc9a7d32eec006017909031eafd85f6a3c92f5ab59520cfb5668b372dab0033090268b5b69747bab2b87139cdbceaeb64adf05f850c37377ee4e2b4

Download Submit
C:\Users\Admin\temp\TeamViewer3\TeamViewer.ini

Filesize
464B

MD5
0c5e8d5fddda4a6f89e8796108a01d59

SHA1
1684a8467750d5ee5dca693c6516b0bb31f6553f

SHA256
d7e157855ff7c7fe042e9016a269cfa5d085d42c70da76a1b89a813765113488

SHA512
312d2c7278daf934ea91474115bea4d96761eab92fee29ea1b3e5662ec149c8edceaeb5ec4ab00cacc3b00deddac4565f17ef46b369e2bb9a27f2d62337ac237

Download Submit
C:\Users\Admin\temp\TeamViewer3\TeamViewer_.exe

Filesize
884KB

MD5
c19e56f4daf7c0e6b53dcfdc9a4216a5

SHA1
bf06fc8c2e083161b7fb11d2623c9bf80d6c5c0b

SHA256
3c7dd6337762b634b1683026a92e92255c4fa9ed19cf93bbe9bfa5beb42e656f

SHA512
bee1b2894981b2e6c30dc411f415b6f00acb2a757f7bdc24c1779777b4f83cec453341894cc06f727a6bec7798f746f3fd44ca3cdbbdbf730aa78177ee0843d0

Download Submit
C:\Users\Admin\temp\TeamViewer3\logo.bmp

Filesize
21KB

MD5
29c70c4c02633a22c402a27024984388

SHA1
aeb95beacc3a4e922bc688f028680bd9a2662131

SHA256
ebce930acc2a6d0c409ac7ebe2e11f5f9341d7d16a3dd8fba0208b98b20aaa31

SHA512
dea3b7acb7b3a2085d26da69edc60fdd177da51449c202cd5caf1f5db92177e9dcec2c0a58c17960053be07ace04c0f0d39bec42f5f17502e1e9f26853b58c08

Download Submit
C:\Users\Admin\temp\TeamViewer3\tv.dll

Filesize
9KB

MD5
5a2e1b4cecb98719af9215ef291a4215

SHA1
48993673bf8d1e89a8baf89eb022c1c54f6b6d6e

SHA256
8d3f87d3d98056f7926202846e7e3098802ae9594b5eac5bc029cf17cedfb1bf

SHA512
bdbbfd4b9d51df8ac8aac7a635ec7a1fd2454c9ddf5be376866348d8d6821f4db1e0f7dcc314849794a2b9ac594236ec4fad4b1cd53b14b0040e325727f9cbb2

Download Submit
memory/100-66-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/100-68-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/2624-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2624-11-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3748-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3748-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download