Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 21:15

General

  • Target

    4f112f651b8025db019ae8089a8d591a_JaffaCakes118.exe

  • Size

    253KB

  • MD5

    4f112f651b8025db019ae8089a8d591a

  • SHA1

    17a81f254644dc7cb89739d0789de51bddf7365d

  • SHA256

    f8fcdb7600d274e4bfbcc4cea1a3484b917956f343fd05c5a3488b5d72dbef8e

  • SHA512

    93fae5fd976fdb22c9acf93918e04d7f0eeab0f9476e0d22b432f4e4e0b344f89a5a32cd97998289efac5c8c59b65c9d27d4a8cb322f36962557f023d1fca21c

  • SSDEEP

    6144:4VFNCNrUiyArOqLVA97qxKD/diPo1S11WXTjiBHk95:UN0UOrXZA97PD/dwWKBHk95

Malware Config

Signatures

  • Suspicious use of NtCreateProcessOtherParentProcess 20 IoCs
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Executes dropped EXE 10 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 28 IoCs
  • Runs regedit.exe 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\4f112f651b8025db019ae8089a8d591a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\4f112f651b8025db019ae8089a8d591a_JaffaCakes118.exe"
        2⤵
        • Writes to the Master Boot Record (MBR)
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Windows\SysWOW64\regedit.exe
          regedit /s C:\Users\Admin\AppData\Local\Temp\$rar10987.tmp
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Runs regedit.exe
          PID:2852
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$RAVSING.bat
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2860
        • C:\Windows\RkRealTech.exe
          C:\Windows\RkRealTech.exe \??\C:\Windows\regedit.exe 1208 C:\Users\Admin\AppData\Local\Temp\bbhhhik.tmp
          3⤵
          • Suspicious use of NtCreateProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2788
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$edbs.bat
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2660
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$rcqi.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\."
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2460
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\.."
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2276
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\desktop.ini"
            4⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            PID:2132
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\GOOGLE~1.LNK"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2664
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\LAUNCH~1.LNK"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1164
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\SHOWSD~1.LNK"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:896
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\USERPI~1"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1324
          • C:\Windows\RtkSYUdp.exe
            C:\Windows\RtkSYUdp.exe filldelete "C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\WINDOW~1.LNK"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1168
        • C:\Windows\RkRealTech.exe
          C:\Windows\RkRealTech.exe \??\C:\Windows\regedit.exe 1208 C:\Users\Admin\AppData\Local\Temp\$rar10943.tmp
          3⤵
          • Suspicious use of NtCreateProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2360
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1600
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:796
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:908
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2296
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:1440
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2888
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:628
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:1640
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2420
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:1788
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:3008
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2912
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:768
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:1836
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:1824
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2024
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:1664
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:1260
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2960
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2012
      • \Windows\SysWOW64\regedit.exe
        2⤵
        • Runs regedit.exe
        PID:2324

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\$$RAVSING.bat

            Filesize

            253B

            MD5

            cb350b29233b3440633123bb77692140

            SHA1

            52793f1ba4c7925d41c6e79a109080c3d12b69e6

            SHA256

            7031fcb0fa967101e4d4894e9ebbac7e0ed00cc3ba57777afa02f521356530d3

            SHA512

            0e5d3b34262260b807179d6a51e2c62524d3b0a132c05c4425830d376d1002d150aa0fd8e747a67d96b8ae8145ab903892ce3eaa8245084832eefd02b31c09b8

          • C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat

            Filesize

            602B

            MD5

            a1132bccc90603d0d1e299920dd5ca20

            SHA1

            46ab3b8e23816d2dc0de5fb3297b017d5b9a51aa

            SHA256

            95d5a933f8eac6102ad16bbe4db6f64f55cbf8abdf09d0a55e5cb34be78ed5d6

            SHA512

            3b35223c5dd11d000c9a757dc3f8f9f36afffb49fc44faea410dd9bff4f44dc0150a38202146a5b399fd18d7f7f8bf8bcba1821dc41a79927814f93501db1a29

          • C:\Users\Admin\AppData\Local\Temp\$$edbs.bat

            Filesize

            59B

            MD5

            0cf180f20e716094bef34db0f1a39a04

            SHA1

            f8e9da5d8eaf347b240a77c6a9c4f494d4fc351b

            SHA256

            2a72298ec1d957d1d225aec50a4e6e32c5dec2f2645f25e580304e5c7ae5bb26

            SHA512

            a471fee35dfc685effb46fcc37d47d7210fad3fdba7cb5342b13e11f95ae7690e4053b3399bca6da7546015a479ce55a301c6934be8bab7ec9eae5aece8bdb3b

          • C:\Users\Admin\AppData\Local\Temp\$$rcqi.bat

            Filesize

            1KB

            MD5

            5ed245d923fd9fa2d236979980bf54e6

            SHA1

            0c8939062da21c2db98575ad1e5fb03d7fa4ab28

            SHA256

            84d64538b8d83661d0e985a5bdb6c498264fc225e95b38ef34c1d5b43ac415f9

            SHA512

            2e2b5ab76bc8a3c2c6a03a9b68e68e284042e495421d179548c1622e221d303987c884a44b0da50a2573ec8e4a38fda990c307c3950a60d221f1387d00cc5b65

          • C:\Users\Admin\AppData\Local\Temp\$rar10987.tmp

            Filesize

            1KB

            MD5

            185038ec1cc9a69a109726c8989e4cf5

            SHA1

            bfb62037297e8533e5f3940a32fb9505acf4fe26

            SHA256

            48ccff6cd96445619998a70fad77f5e655a9d146b93d0d160656619728c4e727

            SHA512

            bb0065a36a9bc48199943b21f3c3f10916fd15aa54201513f344464d962b5e6339e1df1b932043a914a662631f842a2f3b7a2c6e8c4e414567c5ea8ac9950391

          • C:\Users\Admin\AppData\Local\Temp\IEXPLORE.tmp

            Filesize

            1KB

            MD5

            a6fad63d53a0f242688753be4a791373

            SHA1

            b56bf60bd88e783403c46e29b9344e2eb6967dc3

            SHA256

            0eef1845b0b62106594ac8180950e47b8c801851bb3a67bdd0072f63302752d2

            SHA512

            4a8b2b67c665a73f3636956aea32f662e8cb61dd262ee1d6c5327a39385239413a6dac183380af1bbfa65f8ee6db49619447bfc379f49c0f6eb2655fc5ef9738

          • C:\Users\Admin\AppData\Roaming\MICROS~1\INTERN~1\QUICKL~1\Window Switcher.lnk

            Filesize

            64KB

            MD5

            fcd6bcb56c1689fcef28b57c22475bad

            SHA1

            1adc95bebe9eea8c112d40cd04ab7a8d75c4f961

            SHA256

            de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31

            SHA512

            73e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2

          • C:\Windows\RkRealTech.exe

            Filesize

            92KB

            MD5

            3350569bad492f3cf54e6da064a7d5cc

            SHA1

            7ec1de0bdccc409d2193d9827128580e9d53e458

            SHA256

            ba48989d9c5fb3320ded14ab48a372950948c0ba136893e564e3fe0fb3ce7d95

            SHA512

            044187e1e6ac4740689faca5e4f70ad274711f8610a60dcb01c711e5727892da994e458a79d2a6ae80ac1042367cb081553ab83c142f48d4f99996d288ac909b

          • C:\Windows\RtkSYUdp.exe

            Filesize

            30KB

            MD5

            d0cd586c5c857850a188e778b971f25a

            SHA1

            3f584fd89e41151c389b4701d876d2bdd2885fc2

            SHA256

            2f6cd2ed9806a09fecce1f96cd5b3f77fc0339ddbbb4c31aab25e85fd3f268eb

            SHA512

            995f539c7163e0e49c7cc4687dd29dac4ac88501410d8c9935f99d993b14bf5fe349cdcdc9f61d4f308c280536b54f54ae7d041565c73a2340881f68e7b2c41c

          • memory/1324-77-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/1852-49-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/1852-50-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/2276-55-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/2292-58-0x0000000000400000-0x00000000004B7000-memory.dmp

            Filesize

            732KB

          • memory/2292-63-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2292-1-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2292-0-0x0000000000400000-0x00000000004B7000-memory.dmp

            Filesize

            732KB

          • memory/2460-52-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB