Malware Analysis Report

2025-03-14 22:09

Sample ID 250228-ymst6av1ez
Target JaffaCakes118_342751878d07e46f3efd6b853cf06272
SHA256 13b21bf5da95f824edc00639c6cf87462c95709de4b219eb118a6534d8d5cdc3
Tags
vobfus discovery persistence upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

13b21bf5da95f824edc00639c6cf87462c95709de4b219eb118a6534d8d5cdc3

Threat Level: Known bad

The file JaffaCakes118_342751878d07e46f3efd6b853cf06272 was found to be: Known bad.

Malicious Activity Summary

vobfus discovery persistence upx worm

Vobfus

Vobfus family

Adds policy Run key to start application

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of SetWindowsHookEx

Script User-Agent

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-28 19:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-28 19:54

Reported

2025-02-28 19:57

Platform

win7-20240903-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe"

Signatures

Vobfus

worm vobfus

Vobfus family

vobfus

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 2120 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 2120 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 2120 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 2120 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 2120 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 2120 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 788 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 788 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

Network

Country Destination Domain Proto
US 8.8.8.8:53 khant.info udp
US 8.8.8.8:53 khant.me udp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp
US 172.67.133.189:80 khant.me tcp

Files

memory/2120-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2120-1-0x0000000000220000-0x0000000000234000-memory.dmp

memory/788-2-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2120-7-0x0000000000400000-0x0000000000414000-memory.dmp

memory/788-12-0x0000000000400000-0x0000000000543000-memory.dmp

memory/788-10-0x0000000000400000-0x0000000000543000-memory.dmp

memory/788-9-0x0000000000400000-0x0000000000543000-memory.dmp

memory/788-4-0x0000000000400000-0x0000000000543000-memory.dmp

memory/788-5-0x0000000000400000-0x0000000000543000-memory.dmp

memory/788-6-0x0000000000400000-0x0000000000543000-memory.dmp

memory/788-17-0x0000000000400000-0x0000000000543000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6ywfcuhf.exe.jpg

MD5 342751878d07e46f3efd6b853cf06272
SHA1 1d5199f7c879f803d50fa59896f89145e67bd699
SHA256 13b21bf5da95f824edc00639c6cf87462c95709de4b219eb118a6534d8d5cdc3
SHA512 19d64331046e5ff95c99eb98dddb03a72018d504b3471478a62f9e6ea7e2460d295e5a661ecb4f38e34bddb82d8f4f0896dff320fe6be671f08ba81ea5926b64

memory/788-45-0x0000000000400000-0x0000000000543000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-28 19:54

Reported

2025-02-28 19:57

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe"

Signatures

Vobfus

worm vobfus

Vobfus family

vobfus

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AIGILQI7ZEAV5 = "C:\\Users\\Admin\\AppData\\Roaming\\6YWFCUHF.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4152 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 4152 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 4152 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 4152 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 4152 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 4152 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 4152 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe
PID 640 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe
PID 640 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_342751878d07e46f3efd6b853cf06272.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\MSWINSCK.OCX" /s

Network

Country Destination Domain Proto
US 8.8.8.8:53 khant.info udp
US 8.8.8.8:53 khant.me udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp
US 8.8.8.8:53 khant.info udp
US 172.67.133.189:80 khant.me tcp

Files

memory/4152-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/640-1-0x0000000000400000-0x0000000000543000-memory.dmp

memory/640-3-0x0000000000400000-0x0000000000543000-memory.dmp

memory/4152-4-0x0000000000400000-0x0000000000414000-memory.dmp

memory/640-5-0x0000000000400000-0x0000000000543000-memory.dmp

memory/640-10-0x0000000000400000-0x0000000000543000-memory.dmp

memory/640-11-0x0000000000400000-0x0000000000543000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6ywfcuhf.exe.jpg

MD5 342751878d07e46f3efd6b853cf06272
SHA1 1d5199f7c879f803d50fa59896f89145e67bd699
SHA256 13b21bf5da95f824edc00639c6cf87462c95709de4b219eb118a6534d8d5cdc3
SHA512 19d64331046e5ff95c99eb98dddb03a72018d504b3471478a62f9e6ea7e2460d295e5a661ecb4f38e34bddb82d8f4f0896dff320fe6be671f08ba81ea5926b64

memory/640-32-0x0000000000400000-0x0000000000543000-memory.dmp

memory/640-51-0x0000000000400000-0x0000000000543000-memory.dmp