Overview

overview

7

Static

static

3

8270cc8f6e...18.exe

windows7-x64

7

8270cc8f6e...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2024 08:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8270cc8f6e3575c3d6dac84783c7895b_JaffaCakes118.exe

  • Size

    4.3MB

  • MD5

    8270cc8f6e3575c3d6dac84783c7895b

  • SHA1

    43057f92c25747f11bc1c28d04c899cd54003a10

  • SHA256

    7d2f27e40cea3248fe952148b0d636c45a0e196c320bc9e441c186abc7f6bd0d

  • SHA512

    4cadf853469c4a5bc5944d8246da4b62d8e4e506838fde5b799986ba052f4335d5d229eaa8c76f70c552210f40685b6d7a06189147cc428f9d71f5aa346869e2

  • SSDEEP

    98304:hI5plrd55Q8ysqZw5QCVUFYnT3kup/6hoCS4rCwNM4nt:KplR7rnyw5B+AT3kS6hE45Pt

Score
7/10
discoveryupx

Malware Config

Signatures

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 46 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8270cc8f6e3575c3d6dac84783c7895b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8270cc8f6e3575c3d6dac84783c7895b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Users\Admin\AppData\Local\Temp\ae28620\setup.exe
      C:\Users\Admin\AppData\Local\Temp\ae28620\setup.exe -d "C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\CMCT3FR.DLL"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2660
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\COMCAT.DLL"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:664
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\COMCT332.OCX"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:840
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\COMDLG32.OCX"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1720
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\GIF89.DLL"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1192
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\mscomctl.ocx"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:1620
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\msvbvm60.dll"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1768
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\OLEAUT32.DLL"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2076
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\OLEPRO32.DLL"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2472
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\MSINET.OCX"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:960
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\MCI32.OCX"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1080
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\MSCOMCT2.OCX"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:848
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\msxml3.dll"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2104
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\scrrun.dll"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1996
      • C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
        C:\Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe /s "C:\Windows\system32\SSubTmr6.dll"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:916
      • C:\Program Files (x86)\ISOpen\ISOBurner.exe
        "C:\Program Files (x86)\ISOpen\ISOBurner.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\ISOpen\ISOBurner.exe
    Filesize

    40KB

    MD5

    f22837c8c45d5b5d60024cb5d9bcad8f

    SHA1

    c31c64e00082fc75b7aef17114bd087c370f91a0

    SHA256

    7fb3bfab48e5e74a26f2d2964d78ad3856fa474223fd9aa835948d6324ae1837

    SHA512

    63ad9d9209cde18e0c69523e963a1aee4888851959010d63062293008ee6fd1ffc8abaa30be69a7c1129dbce8eef2793f56198a6d8a3dc8ab8490c01a8ebea37

    Download Submit

  • C:\Program Files (x86)\ISOpen\ISOpen.exe
    Filesize

    367KB

    MD5

    dd6d045d04d823a11a370267763d2f0c

    SHA1

    e1add69fa0395bbb0e0d7c1f0179238eb7bbd15a

    SHA256

    9203b659ef2223d6dc551d6c68eda249b11565440b70e07d2e82bebeca4feb55

    SHA512

    c27e57a1e1f5cfd1113b4ee755286bd973a5aa071458445c4e883e21940c92d8fd7700d370ea1f05c0c880fdf46560d0b2dcf3520c66cbce199fadef6dcf310a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ae28620\English.dat
    Filesize

    5KB

    MD5

    11075490b216306d47156dd9c9db9b52

    SHA1

    b7549823c0c9e147e0c0735291da9d2c7e84b768

    SHA256

    1f8ada3c4bbd62495b3747bdffe6f1745f7484ce86045e7227515f27d2253fe4

    SHA512

    b5a62d042a3146290a4bb5fff35908bbe8cc1a3f1572afa3a5f27846a191eca98d93698984f8bb6b605b9c3421d3451d1d607b0361ef552b26cb882faaa2b50d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ae28620\Setup.ini
    Filesize

    4KB

    MD5

    9c09600e62f0001a701ccaeabed8f67b

    SHA1

    c89690c00e04d48c773c05c5dca09f43eff66175

    SHA256

    be931922461aa31c158cf59bc100fd9451a6dfd920c6fa18ba9216ef7f504389

    SHA512

    dac81d6cab5920e0f5f4b84d57bd2eb627b69b2fdec9eef9e0cf174d0d2de3ff1afffb9d4db24fe212e9b0894c3bf0905590d04d9dd9a7d27de44330ff066493

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ae28620\setup.zip
    Filesize

    4.1MB

    MD5

    4949fe140f056040afedfa1e5ec9f6ae

    SHA1

    703ee6d309ee2cf925e81fae876092f745d1d27f

    SHA256

    e006bff40df6bfeae08cdc7ca481b61839c3a24a721a1ca46c2bf923a87eff48

    SHA512

    e410fe6666f099f3f675428763c3a66da96c80d478e960928d0568fd29aa5a8d585fcf80841b6914e3b9c664279d85f6268871c99bdf050905ded8f02b3e37d5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp3692.tmp
    Filesize

    1.1MB

    MD5

    88e5618f62912ad2c4fd2832b5bcb63f

    SHA1

    3876ea4233b27b09a67eddbadcc9aa396960974b

    SHA256

    19413ced1c7791a699c5469bd466d1b002bb0366961305408d1eb0e2e96dfc7d

    SHA512

    59cc16d4cdd6ce9dbe2f00bee5261da9798905f008fc574537a5a92b9ba27c9121a9a02cbde5a4851371ccfd25fbd1358b0dec794680bf7366071f216bb1191f

    Download Submit

  • C:\Windows\SysWOW64\CMCT3FR.DLL
    Filesize

    28KB

    MD5

    3ef5966521538b55ac01938ab03ff6a2

    SHA1

    7c9b00f4f53e6f26207c16696d77d93325262fd8

    SHA256

    5c83a7aa92d683769fe1466da50e13442a36497c86307a07c495036b4cca403c

    SHA512

    8c228a5bd25b71415fbba8c18150aa81dce6c415bc5d96f9eaa936f00a61cc40bd039127842332448c47a94689b9f151f5af7cb612d6415252f081deda7e89eb

    Download Submit

  • C:\Windows\SysWOW64\COMCT332.OCX
    Filesize

    405KB

    MD5

    821ab1f1cf9904cb9026c686f13f0f05

    SHA1

    398f64c00b026d1c6d94a6efd180f20c010f5ee9

    SHA256

    332e6a1cb4bf722092f9e774ecc14acddbf95a9655bea021681b11aac37ac716

    SHA512

    d63c0facd14adfca4e7e1e6d99d1fd1c2be89c2c03e9835c506418a6a3facb745888062bdf97cdab0ad67cc8bccb385ae10955f58150d9c4ac4a7c61e5c1e559

    Download Submit

  • C:\Windows\SysWOW64\COMDLG32.OCX
    Filesize

    137KB

    MD5

    d76f0eab36f83a31d411aeaf70da7396

    SHA1

    9bc145b54500fb6fbea9be61fbdd90f65fd1bc14

    SHA256

    46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c

    SHA512

    9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d

    Download Submit

  • C:\Windows\SysWOW64\GIF89.DLL
    Filesize

    43KB

    MD5

    fb00273cf7ce639c136853f3fc04b10c

    SHA1

    16e612d7a4f210e78426577cd77f349306ab018a

    SHA256

    d4916f5c35a94e87cef46a63b4f19fb842252e0e2857b7804c808c94926156e0

    SHA512

    5e4bc9ce74bf81171e4a7fc6168b0dfc50268ff0069549bbf7cd0d480df9882911f4a31183d8d6c0222bede39d7d3216ad4e8c553501c376eeb0abe454fce6a8

    Download Submit

  • \Users\Admin\AppData\Local\Temp\ae28620\Regsvr32.exe
    Filesize

    36KB

    MD5

    7b194f51f6b52233c33a7d0d88a91581

    SHA1

    459dc713fd52197d025fb7b4b4833ed5dca73a87

    SHA256

    7c05339da12624396d9911263dc7c993fc2e757e130009465a511045bf06d344

    SHA512

    dd835fa6d8f57159ff045bc3c89d1eea965411a34f1a8d0232ed58a1fde885cb3e489fdd01d2bf31aec606130a6b6dc6e3e7602ecb852326dc293604793504cc

    Download Submit

  • \Users\Admin\AppData\Local\Temp\ae28620\setup.exe
    Filesize

    149KB

    MD5

    536d65fb4fc58c60cb9693360d36f536

    SHA1

    71bd50765c01cdd264fc647ca5fb34dfffd3499b

    SHA256

    79f851fc387d00331e82ac34ae9840a53b034ba9de977f84e216593fd5e6111a

    SHA512

    fd5cf95dd416fa7e708df3604821cc8aa0a0e6385dd3a83367b65bae6c3e0817ca1dc5e3fe4fb6e8fe24b1a612dac395e7d41284f6927b254ffcf58878591fe7

    Download Submit

  • \Users\Admin\AppData\Local\Temp\tmp2896.tmp
    Filesize

    140KB

    MD5

    fc152d48b806bc5167a9de010181f1b7

    SHA1

    d38fc4323220c7ab5be27365159e8f910935a3d8

    SHA256

    960b59a0108573d18f8b1bfeeccf561bc1893035ea5814598875ca1a664e16d0

    SHA512

    67dbb11e3186dcfe0720596dacc68d5469989a970925c0e25183b460bfd56c4db8c35677d59785d5ac64a4351c95a780480dbbf3787b0fe27c5084f52f80e560

    Download Submit

  • \Users\Admin\AppData\Local\Temp\tmp29FE.tmp
    Filesize

    21KB

    MD5

    3b180da2b50b954a55fe37afba58d428

    SHA1

    c2a409311853ad4608418e790621f04155e55000

    SHA256

    96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03

    SHA512

    cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8

    Download Submit

  • \Users\Admin\AppData\Local\Temp\tmp2D98.tmp
    Filesize

    1.0MB

    MD5

    714cf24fc19a20ae0dc701b48ded2cf6

    SHA1

    d904d2fa7639c38ffb6e69f1ef779ca1001b8c18

    SHA256

    09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712

    SHA512

    d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

    Download Submit

  • \Users\Admin\AppData\Local\Temp\tmp2F5D.tmp
    Filesize

    1.3MB

    MD5

    3496686b7304f0034f58d3417ba1b6b6

    SHA1

    53565a271e708321836a6274000cfec462e81b0d

    SHA256

    088e9a0ec5dcdbb3d1deb412c32087c93dcf9c757b5d97ab93d7f7f91c2091ff

    SHA512

    8769843d1b9a2bd5980c1db1707f906e4f123aaf3fd38c76447dbf70f67e5c536fd7b629c753d2a0696aa4049a98a705ad2bcd1b79a29b6a582feba897d82fa2

    Download Submit

  • memory/716-262-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/716-258-0x0000000000230000-0x000000000025A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/716-259-0x0000000000230000-0x000000000025A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/716-257-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/2572-10-0x0000000002150000-0x00000000021C1000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3008-177-0x0000000000860000-0x0000000000889000-memory.dmp

    Filesize

    164KB

    Download

  • memory/3008-241-0x0000000002B60000-0x0000000002B70000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3008-16-0x0000000000230000-0x00000000002A1000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3008-253-0x0000000002B60000-0x0000000002B8A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/3008-236-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3008-20-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3008-84-0x0000000000860000-0x0000000000884000-memory.dmp

    Filesize

    144KB

    Download

  • memory/3008-171-0x0000000001FE0000-0x0000000002075000-memory.dmp

    Filesize

    596KB

    Download

  • memory/3008-64-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3008-263-0x0000000000320000-0x0000000000330000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3008-264-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3008-267-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

    Download