Overview
overview
10Static
static
10JaffaCakes...cc.exe
windows7-x64
7JaffaCakes...cc.exe
windows10-2004-x64
10setup_akl.exe
windows7-x64
10setup_akl.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
8AKV.exe
windows7-x64
3AKV.exe
windows10-2004-x64
8HTV.dll
windows7-x64
3HTV.dll
windows10-2004-x64
3HTV.exe
windows7-x64
6HTV.exe
windows10-2004-x64
6HTV.dll
windows7-x64
3HTV.dll
windows10-2004-x64
8HTV.dll
windows7-x64
3HTV.dll
windows10-2004-x64
8HTV.chm
windows7-x64
1HTV.chm
windows10-2004-x64
8HTV.exe
windows7-x64
6HTV.exe
windows10-2004-x64
6Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
8qs.html
windows7-x64
3qs.html
windows10-2004-x64
8update.exe
windows7-x64
3update.exe
windows10-2004-x64
8Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2025 10:04
Behavioral task
behavioral1
Sample
JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_da3966b99a53642d23b1767a56fe5bcc.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
setup_akl.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
setup_akl.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20250207-en
Behavioral task
behavioral7
Sample
AKV.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
AKV.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral9
Sample
HTV.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
HTV.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
HTV.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
HTV.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
HTV.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
HTV.dll
Resource
win10v2004-20250207-en
Behavioral task
behavioral15
Sample
HTV.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
HTV.dll
Resource
win10v2004-20250207-en
Behavioral task
behavioral17
Sample
HTV.chm
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
HTV.chm
Resource
win10v2004-20250207-en
Behavioral task
behavioral19
Sample
HTV.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
HTV.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral23
Sample
qs.html
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
qs.html
Resource
win10v2004-20250207-en
Behavioral task
behavioral25
Sample
update.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
update.exe
Resource
win10v2004-20250207-en
General
-
Target
AKV.exe
-
Size
395KB
-
MD5
b8fa30233794772b8b76b4b1d91c7321
-
SHA1
0cf9561be2528944285e536f41d502be24c3aa87
-
SHA256
14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
-
SHA512
10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
SSDEEP
6144:qXXNW/g8zSQbXumJZwsP2IUPNF/GVx8MFC:+XbySQjuG/P2bd
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 52 1236 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2952 MicrosoftEdgeUpdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2696 AKV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AKV.exe"C:\Users\Admin\AppData\Local\Temp\AKV.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2696
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTAwNDM5NjctMTYwQy00MkFELTg5QkUtNTg2RTZGMzBGM0U3fSIgdXNlcmlkPSJ7RTUyMERGMjMtMzBEMS00QTY4LTk2QTMtREM3OEYxN0M3NkY1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjNGOTUxMTEtRkQ4Ni00OEZFLUE4NTgtQTc1NDJBQ0I0QjZEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDQ0OTciIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxNjkzODEzMjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTAxNzQ4MzAxIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2952