07c31fcbacced87e8075b71528bdd18c5f88169327a72998d7b3e685ccd7dcd4

Analysis

max time kernel
94s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe
Size 253KB
Sample250127-y978csvnbp
SHA256 07c31fcbacced87e8075b71528bdd18c5f88169327a72998d7b3e685ccd7dcd4
MD5 436bafbdf441fa215ec3511e02e7ca3e
SHA1 48bd660899666ce3cec657d6cddbf1e592920971
SHA512 a756bbd76cfff0ffd78d5484fc889f843cdc535be1c6ee32f29cc1a3096fc972874362dd502140842f6df3da230460e2a0f0fe50ceb8c625b03f9d9d9daa255a
SSDEEP 6144:md93ZBZMbqYgomHmcRUTV5nUliOZ9xvDHIbCan8WiQZWq0z19ck:mr3ZBIRARUTV5nlOfxiR8EN0Ek
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	crmiy.sfx.exe

Executes dropped EXE 2 IoCs

pid	Process
4420	crmiy.sfx.exe
4872	crmiy.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zewfm.exe	crmiy.exe
File opened for modification	C:\Windows\SysWOW64\zewfm.exe	crmiy.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4872-22-0x0000000002060000-0x00000000020E0000-memory.dmp	upx
behavioral2/memory/4872-24-0x0000000002060000-0x00000000020E0000-memory.dmp	upx
behavioral2/memory/4872-25-0x0000000002060000-0x00000000020E0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	crmiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crmiy.sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crmiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	crmiy.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main	crmiy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	crmiy.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe
4872	crmiy.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	crmiy.exe
Token: SeSystemtimePrivilege	4872	crmiy.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4420	1144	JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe	83
PID 1144 wrote to memory of 4420	1144	JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe	83
PID 1144 wrote to memory of 4420	1144	JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe	83
PID 4420 wrote to memory of 4872	4420	crmiy.sfx.exe	84
PID 4420 wrote to memory of 4872	4420	crmiy.sfx.exe	84
PID 4420 wrote to memory of 4872	4420	crmiy.sfx.exe	84
PID 4872 wrote to memory of 3360	4872	crmiy.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_436bafbdf441fa215ec3511e02e7ca3e.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\crmiy.sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\crmiy.sfx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\crmiy.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\crmiy.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crmiy.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\crmiy.exe
Size 99KB
SHA256 ef0361408091f5a4a323fedc59ae0e0bb34ed5a46e69ef5129b616960dfef60e
MD5 1bdf5c4911434109880475e4f8c5a525
SHA1 3b3b8680b3489023feea2190d9abb9167b2310c3
SHA512 c3966291b45d8ead81594b9cce1b5ddeb58342105bf2795a008019753fac1cc4f959f240fb2b292ae191c8b4e678d3da4d42a6adaf0b161c447b7f75d99b00a8
SSDEEP 1536:Ewxh/kSuLrFBhzCVoC4hsUH+TZiPiC08xL54CTdShXnHQw826SUT:BxdhuLrz8eC6eTZ6iD8xLhdMXHc2Bm
MD5 SHA1 SHA512 SSDEEP

Submit Download

crmiy.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\crmiy.sfx.exe
Size 184KB
SHA256 48fff08ecae4f28e511b29f051f55aab44d857cb5689ced70f3e1c564ac571b2
MD5 c7a20a7cb2eb3540f0244492ab1fcdc2
SHA1 a8282e2b566681614c422c397d166d0d92aca40b
SHA512 e9eb1aeda1e9b5ba183099c2c8194158c42f6ca72f9c36b1119cb296b7fd51c190d1bc959bbc7866e401c862c96552fe726a9296301b737142e69e7cd1ab9f19
SSDEEP 3072:8d9xR3G2BZMbBLBaYw0coLujNHm8Hc16+VL27w9QMLMWUKYJYYd9Z6Mby:8d93ZBZMbqYgomHmXg+bQaZYJTYMby
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1144-28-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4420-21-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4872-20-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4872-22-0x0000000002060000-0x00000000020E0000-memory.dmp

Download

memory/4872-24-0x0000000002060000-0x00000000020E0000-memory.dmp

Download

memory/4872-25-0x0000000002060000-0x00000000020E0000-memory.dmp

Download

memory/4872-27-0x00000000005A0000-0x00000000005B0000-memory.dmp

Download

memory/4872-29-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/4872-33-0x0000000000400000-0x000000000043D000-memory.dmp

Download