Overview

overview

7

Static

static

3

JaffaCakes...72.exe

windows7-x64

7

JaffaCakes...72.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2025, 14:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    JaffaCakes118_40bba877e43c9e6e3295c9e67c86be72.exe
  • Size 104KB
  • Sample250127-sa9dgstnas
  • SHA256 c2573a60405a6a8d9c116bba2a30a8baaad7c6267c430bd0b025ab2c4077e5d6
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies registry class 60 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40bba877e43c9e6e3295c9e67c86be72.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40bba877e43c9e6e3295c9e67c86be72.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2824
    • \??\c:\Q69F7V.exe
      c:\Q69F7V.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4408
    • C:\Windows\SysWOW64\WScript.Exe
      WScript.Exe jies.bak.vbs
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:4448

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Q69F7V.exe
        • Path C:\Q69F7V.exe
        • Size 10KB
        • SHA256 1996fe9ed644096502208bfec76a68cf6aced6143e94dabfb15a5fe52ab20687
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Size 471B
        • SHA256 25f890730498e80c6b85f0ca869917f45af6cadbb427695a615181eac3285dc2
        • MD5 SHA1 SHA512
        Submit Download

        7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        • Size 404B
        • SHA256 31fc3c71e5d432d2fbf3908d824914845663ca320c175192f0b73f7dcbdad6f9
        • MD5 SHA1 SHA512
        Submit Download

        suggestions[1].en-US
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O4PTG2YB\suggestions[1].en-US
        • Size 17KB
        • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        jies.bak.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\jies.bak.vbs
        • Size 450B
        • SHA256 3bf2347672b4f8197ccd039bb93301fe4d56419a5eb3bb93586d3932b827f0af
        • MD5 SHA1 SHA512
        Submit Download

        memory/1400-12-0x0000000000400000-0x000000000040A000-memory.dmp
        Download

        memory/1400-23-0x0000000000400000-0x000000000040A000-memory.dmp
        Download