Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 12:24

General

  • Target

    JaffaCakes118_c7b6e5fcb3c51c4cbd9058d90d088bf6.exe

  • Size

    2.2MB

  • MD5

    c7b6e5fcb3c51c4cbd9058d90d088bf6

  • SHA1

    b2057fcbac47dfa1c92df2ad0a3d6f78aefe00a8

  • SHA256

    4bd6365e1357e4d66aeb3b4d97da320316d01830b362ea6a61ce159e81c1c707

  • SHA512

    8f57c6450979ff9bdfaf5fd1431f339999e7388e0ed60247acc188c7688beba273a2aa8351cdcd1eca260308b8750f5a5fbda7c78121d9a227c727abc9a7fd9e

  • SSDEEP

    49152:e1UsIvTfS+rb9188MVfdzM3oNMLoZ6M4ejnXxrkHxLI5:BtvTfSu9xofd/Ns58Jt5

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Drops file in Drivers directory 4 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unexpected DNS network traffic destination 36 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7b6e5fcb3c51c4cbd9058d90d088bf6.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7b6e5fcb3c51c4cbd9058d90d088bf6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7b6e5fcb3c51c4cbd9058d90d088bf6.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7b6e5fcb3c51c4cbd9058d90d088bf6.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7b6e5fcb3c51c4cbd9058d90d088bf6.exe"
      2⤵
      • Enumerates VirtualBox registry keys
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Adds Run key to start application
      • Checks for any installed AV software in registry
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Windows\SysWOW64\Wbem\mofcomp.exe
        mofcomp "C:\Users\Admin\AppData\Local\Temp\7133.mof"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3968
      • C:\Windows\SysWOW64\netsh.exe
        netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7b6e5fcb3c51c4cbd9058d90d088bf6.exe" "PC Security Guardian" ENABLE
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4828
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.com 8.8.8.8
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2744
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.net 8.8.8.8
        3⤵
        • System Location Discovery: System Language Discovery
        PID:936
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.com 208.67.222.222
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3016
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.net 208.67.222.222
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3388
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.com 8.8.4.4
        3⤵
        • System Location Discovery: System Language Discovery
        PID:448
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.net 8.8.4.4
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1684
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.com 208.67.220.220
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2372
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt kll140syfjllnraj.net 208.67.220.220
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1852
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.com 8.8.8.8
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1416
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.net 8.8.8.8
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1844
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.com 208.67.222.222
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4440
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.net 208.67.222.222
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4820
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.com 8.8.4.4
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3548
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.net 8.8.4.4
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1700
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.com 208.67.220.220
        3⤵
        • System Location Discovery: System Language Discovery
        PID:888
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt cllr406rswfjprx.net 208.67.220.220
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3872
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.com 8.8.8.8
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1312
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.net 8.8.8.8
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1376
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.com 208.67.222.222
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3152
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.net 208.67.222.222
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3328
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.com 8.8.4.4
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1440
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.net 8.8.4.4
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1048
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.com 208.67.220.220
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4980
      • C:\Windows\SysWOW64\nslookup.exe
        nslookup -q=txt gpwbipwb1035fhnp.net 208.67.220.220
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4060

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\74377\PSd98.exe

          Filesize

          2.2MB

          MD5

          c7b6e5fcb3c51c4cbd9058d90d088bf6

          SHA1

          b2057fcbac47dfa1c92df2ad0a3d6f78aefe00a8

          SHA256

          4bd6365e1357e4d66aeb3b4d97da320316d01830b362ea6a61ce159e81c1c707

          SHA512

          8f57c6450979ff9bdfaf5fd1431f339999e7388e0ed60247acc188c7688beba273a2aa8351cdcd1eca260308b8750f5a5fbda7c78121d9a227c727abc9a7fd9e

        • C:\ProgramData\PSRMRG\PSIXG.cfg

          Filesize

          196B

          MD5

          6e86650ad96258b23f022605c5f202d5

          SHA1

          321290e91871cb653441e3c87ee8b20ab5f008a0

          SHA256

          8c39246796530ee7588fc16486335d00d5b7273ebb26efe5833e4cfc2bcfe223

          SHA512

          e8a7bdf4bd2fba233a1a6cdf977d57dcb37ae46bc52bf29b4d23c6294e769069e146bcb5f56c4edbc3f93d38a226a9349f604b54156696ccdef41106cc05060c

        • C:\ProgramData\PSRMRG\PSIXG.cfg

          Filesize

          385B

          MD5

          9b5dd3a84ef3c61e20bf565f5a446d79

          SHA1

          fc35036fb03ee83cee9d5dc576a0d1628e0eb79e

          SHA256

          705a6156679e44205f8a5b42950ca3e85120e34b5d504f0d3936598e3f0ac3f6

          SHA512

          937218480305bc57cc046f4e2fc98dd402ad686571a44071732c8a5865398d111c56e2af57526cf1b346b15fa3f0c7b5cb34b6c02758354b476dccd151853c25

        • C:\ProgramData\PSRMRG\PSIXG.cfg

          Filesize

          2KB

          MD5

          8726c69e8f4d01cc58895294b704281a

          SHA1

          135f4a814135a24960e0c73240723e6a7162302b

          SHA256

          70a1118b94b74711f28334e2bb79ad2f052e723415b283b08fbe93243d98fb9f

          SHA512

          ddcda26c6c6b350245947646156a30a0b23420dae816d1b5ca03a1f63398ab2c702fc87efe6869a5b344c5b703fd473477518f873c7e9c33a1ab1f1ea2a2dded

        • C:\ProgramData\PSRMRG\PSIXG.cfg

          Filesize

          2KB

          MD5

          bbfeecdf0b80a981d02b333151678f28

          SHA1

          a3488be9cf67b1724afb6e210b75f67ea1b846d2

          SHA256

          f45d461cd1ffc995bafd1d2469904099dec8e7d08eedb8042df39f48146ee2b5

          SHA512

          838a54c74e766ec728e6f02102c6a098545665963e8b998cb0e31f79483db1ee5ddb77f13c26a360bcdd15ca218a1e20edbddcf86e0124fa2983711b83fade79

        • C:\ProgramData\PSRMRG\PSIXG.cfg

          Filesize

          2KB

          MD5

          1cc617d857f7fa93093c29deb7d66b6b

          SHA1

          5f2cfedaf055ae8ddc99a4ed59f7ac4acf015126

          SHA256

          6a685f497708e617af448a2587a881dbb1b51eaacf6e6e1ee7a81c1dfb9e69fa

          SHA512

          a009450e54e1b6eae9093949bf529c5af654172da66cf79cbedebb94945ac88e27863e5918d7d085f5cb3a959caf84faa5ee0d9e1a2691d4f2b2c127f629c10e

        • C:\ProgramData\PSRMRG\PSIXG.cfg

          Filesize

          185B

          MD5

          b8224e5293d4fad1927c751cc00c80e7

          SHA1

          270b8c752c7e93ec5485361fe6ef7b37f0b4513b

          SHA256

          c47da9be4fc4d757add73c49654c9179067af547d0cc758d6356e2955bbfcb61

          SHA512

          8fed9a509e46319529145fa2159251e43040d26080af84e44badaab1dd339c767ff75a2c473bc0abfb448b03beb96718ee34ba6bc150ed3085322878b55a22f2

        • C:\Users\Admin\AppData\Local\Temp\7133.mof

          Filesize

          338B

          MD5

          f1105ae1645a228e4054effbed8c2901

          SHA1

          5a7940e396bcbcb7e8f3275e880811c3b10d1edf

          SHA256

          7e46f4279ddc4d534d8825da38d1fd6f8d9cce2f13c4768d3f28a7fe2f0c3e2b

          SHA512

          0e4f1fbd1e1da4c518aa26268d002fa837e31fdd95070a4081b971c24a86c56b0a5b1cf5b420a05fdbc1d60f78a19abde2bff9f4c30c44cbaedc8439756f4ddf

        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js

          Filesize

          11KB

          MD5

          1f9ae3566e6e15208c2d525ac99b1c8a

          SHA1

          61704dd0fd4f5955aec3187f381eb3e04eed85aa

          SHA256

          6e544c24c43d8a6084d83dcd3cff42a8480b5776b0dbe7be9b000f558e2fb373

          SHA512

          b74dbc4db05579767f01dd17e1c8d75b7e80a3e52626ec39daacd5cb559e8a8aecd628a5384f49888f766fd73cb770761c6a0deebdf8f3d0f825ac6d1bc20e4c

        • C:\Windows\System32\drivers\etc\hosts

          Filesize

          1KB

          MD5

          008fba141529811128b8cd5f52300f6e

          SHA1

          1a350b35d82cb4bd7a924b6840c36a678105f793

          SHA256

          ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84

          SHA512

          80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc

        • memory/1960-341-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-309-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-284-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-268-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-272-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-271-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-267-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-285-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-286-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-287-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-312-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-389-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-391-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-399-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-387-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-1-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-340-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-266-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-5-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-6-0x0000000000C60000-0x0000000000C61000-memory.dmp

          Filesize

          4KB

        • memory/1960-311-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-4-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-333-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-277-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-308-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-404-0x0000000000C60000-0x0000000000C61000-memory.dmp

          Filesize

          4KB

        • memory/1960-408-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-410-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-411-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-412-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-414-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-415-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-424-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-423-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-425-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-426-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-3-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-486-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-437-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-438-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-442-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-453-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-463-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/1960-464-0x0000000013140000-0x000000001372D000-memory.dmp

          Filesize

          5.9MB

        • memory/3728-2-0x0000000000400000-0x0000000000646000-memory.dmp

          Filesize

          2.3MB