Analysis

  • max time kernel
    3s
  • max time network
    5s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2025, 14:12

General

  • Target

    JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe

  • Size

    600KB

  • MD5

    8abe43cb15a9dd8d69f77c0c833c6809

  • SHA1

    a011f0a13161d2dac9f01e609af99a4afc39b871

  • SHA256

    fab208d4fde711f95e4da7fdfe3d7855f866bd2f367570aac74320952291faa1

  • SHA512

    e66d77f0df46f46d278a9c22f204d346cbc9a4028d433307967421c9d62f4d54d26d5c8cd23511e733941c15b086e9d92925d5d55c5402770bdd90b509df2b1a

  • SSDEEP

    12288:46onxOp8FySpE5zvIdtU+YmefaRfMMMMM2MMMMM:swp8DozAdO9aRfMMMMM2MMMMM

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

  • Pykspa family
  • UAC bypass 3 TTPs 1 IoCs
  • Detect Pykspa worm 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\izfuneuesjp.exe
      "C:\Users\Admin\AppData\Local\Temp\izfuneuesjp.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_8abe43cb15a9dd8d69f77c0c833c6809.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\nabmjdvnxjhuqqolch.exe

    Filesize

    600KB

    MD5

    8abe43cb15a9dd8d69f77c0c833c6809

    SHA1

    a011f0a13161d2dac9f01e609af99a4afc39b871

    SHA256

    fab208d4fde711f95e4da7fdfe3d7855f866bd2f367570aac74320952291faa1

    SHA512

    e66d77f0df46f46d278a9c22f204d346cbc9a4028d433307967421c9d62f4d54d26d5c8cd23511e733941c15b086e9d92925d5d55c5402770bdd90b509df2b1a

  • \Users\Admin\AppData\Local\Temp\izfuneuesjp.exe

    Filesize

    320KB

    MD5

    5203b6ea0901877fbf2d8d6f6d8d338e

    SHA1

    c803e92561921b38abe13239c1fd85605b570936

    SHA256

    0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

    SHA512

    d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471