Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 23:13

General

  • Target

    4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe

  • Size

    87KB

  • MD5

    4f8b232e9457f18be375b581686fa3b1

  • SHA1

    9b23300034ef4da04d59b0e1c769b47e196759e6

  • SHA256

    1ad13998ccd9c464bcc99a520821b67c24fdb2268bfa9fe4c5cc85dc16ead024

  • SHA512

    d7f310143860b44713047aa174066450ab02739fda1b15ede3555a3d3a43d039aa632ecf710e82bb56fd6b6e64297c6f78f847f88344d114e5353c9a7fd9a375

  • SSDEEP

    1536:56jasnxpEezz5/6HEaPu1dMCzeUlrLNPl5bsfd1MCNFkmhuvfjUWhvjvD/9VPORo:56jasnx7zz5/6HEGuP1aUXNvE1TPkm8b

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4f8b232e9457f18be375b581686fa3b1_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\System32\ydile.dll
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2628
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 ccy6499.dll , InstallMyDll
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1844
    • C:\Windows\SysWOW64\Dofake.exe
      C:\Windows\System32\Dofake.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2876
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\System32\taoba_1.dll
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:400
    • C:\Windows\SysWOW64\cpa_1.exe
      C:\Windows\System32\cpa_1.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\SysWOW64\explorer.exe
        explorer
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 375519961O57540.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3704
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3452
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
    1⤵
      PID:4300

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\375519961O57540.bat

            Filesize

            2KB

            MD5

            682fd3a4162e12281a52a7a43df4d2f9

            SHA1

            d4e51b0efecbb7f0115bc4a8a4dfd45d277d165a

            SHA256

            d56a3c7d69756a627e20577f1cf888cddd8741c69947662c2817d2623f6caa75

            SHA512

            759c30ebce7e5c96eb5b0a829b58e1586880cb0db31c89836cbce8d73f475eeeb5ebf3e0bff2ea6ebc0b02fe58eae28b2d7f55059227e314754ccfa0e962bd53

          • C:\Windows\SysWOW64\Dofake.exe

            Filesize

            72KB

            MD5

            5aebe3daaaa5b3101c10faf213f362e2

            SHA1

            e14eca13088bdf2e717b3f77273da8c6bd58c7f1

            SHA256

            97c4d2f5b7d41bfe67b5c1f7177cbb04628a9a5d09d21c1d0f2e6865843d56c7

            SHA512

            38707a3d8ef5b3407accb3caf8ec807bc509d7cc9af6f73998b99cec2dc2489140924c9038258620cb80662ff0e604455380ad9c80625e3b66a7cad1b74d329f

          • C:\Windows\SysWOW64\ccy6499.dll

            Filesize

            112KB

            MD5

            eab4d3ae8c9f2ba262802b21b96d99fa

            SHA1

            e66f6b9b9f272238514dd8242d9ce9ba2c73ff04

            SHA256

            55ae6670a0f1f69354883e67c5ed9c216dcd7bf133108bda8cfa308e916cad4b

            SHA512

            5a50d643c5f10935a1c9561a4aba1b3b860f45b1a741f8ad58e6b6ed1f254cc82456e1f23dd4a6416ee81e5d681ac0f86022204ec11f4daa0686b9b2997978e8

          • C:\Windows\SysWOW64\cpa_1.exe

            Filesize

            36KB

            MD5

            481d889fdf7c229a0cbee2a4306bdec8

            SHA1

            3dd11c05e2c574083a88ec5ce02af3c24ef27dd4

            SHA256

            038ce6624bd5ba6a7f2d416b0f9b6aa4147efa896c757ebcbb450fde22bb0226

            SHA512

            1a778d97c3b5bda0e7a5d7097631e192a014daab11180646510b59d498a8aa2638d672785daeb410ff38715a399ac306abc5b303d18b93194218dd48174dcc10

          • C:\Windows\SysWOW64\taoba_1.dll

            Filesize

            32KB

            MD5

            92d98e99b7f407edf3f22112b4820334

            SHA1

            1644c2f67918ffdd267cdd554a3ffe3e9ea542ea

            SHA256

            8b271999d7cf97556a64a22e4603a8def932515c2131ca05eb48809de481b703

            SHA512

            a71c07ef0082337fc99587354dc5a169ee2c8fd6d57edf430aae2cfa40f15f57e60f9c9b35b2e2f7550a19cd0271f50849ae4af1f40c54083d28a042b4468ba6

          • C:\Windows\SysWOW64\ydile.dll

            Filesize

            56KB

            MD5

            f0508d5e39bfed1f9f5b5ae9a062ea6e

            SHA1

            32c16f35f62d4a2d30f7dce507bee850f029ef7a

            SHA256

            a85c7d3290a25a44be1f858521da0e777ae62a44ddc0a0f18113ef55549d8a19

            SHA512

            1cc766b0b289eda8651509d7843be239ef04612b74f8f22552c643543ebafde6b65919b37c3a0b5da8a496eeab5d1ffff12702a1b0d3da5d1a651c8700a4bd29

          • memory/3888-0-0x0000000000400000-0x0000000000459000-memory.dmp

            Filesize

            356KB

          • memory/3888-7-0x0000000000400000-0x0000000000459000-memory.dmp

            Filesize

            356KB

          • memory/3888-27-0x0000000000400000-0x0000000000459000-memory.dmp

            Filesize

            356KB