Overview

overview

10

Static

static

3

JaffaCakes...67.exe

windows7-x64

10

JaffaCakes...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    22s
  • max time network
    38s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 17:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8e0598bce0b73645c97c9f7db2559c67.exe

  • Size

    600KB

  • MD5

    8e0598bce0b73645c97c9f7db2559c67

  • SHA1

    bc9a5043bf0c7ea5f476f02b350d700c333b773f

  • SHA256

    126804dd7e7c5b137beee74e61e9be1bda1f98237d47653e27a5d84838d221dd

  • SHA512

    54f62747968fdfb5a136947c70e49f30795f4ceba86aeb9ed2789e82c38c3be89e5305b2678ccf7bd88b898bfc3c38de8efc8f44fa1c7a464defb61133044b31

  • SSDEEP

    6144:Jj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrion:56onxOp8FySpE5zvIdtU+Ymef

Score
10/10
pykspadefense_evasiondiscoverypersistenceprivilege_escalationtrojanworm

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Pykspa family
    pykspa
  • UAC bypass 3 TTPs 13 IoCs
    defense_evasiontrojan
  • Detect Pykspa worm 2 IoCs
    worm
  • Adds policy Run key to start application 2 TTPs 15 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 6 IoCs
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
    defense_evasion
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 45 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    defense_evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 38 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e0598bce0b73645c97c9f7db2559c67.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e0598bce0b73645c97c9f7db2559c67.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe
      "C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_8e0598bce0b73645c97c9f7db2559c67.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2776
      • C:\Users\Admin\AppData\Local\Temp\yjnscdn.exe
        "C:\Users\Admin\AppData\Local\Temp\yjnscdn.exe" "-C:\Users\Admin\AppData\Local\Temp\xreslvogwidjmeay.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:1796
      • C:\Users\Admin\AppData\Local\Temp\yjnscdn.exe
        "C:\Users\Admin\AppData\Local\Temp\yjnscdn.exe" "-C:\Users\Admin\AppData\Local\Temp\xreslvogwidjmeay.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2076
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\yvlcylhcvkirxsrsexc.exe
      "C:\Windows\yvlcylhcvkirxsrsexc.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe
        "C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe" "c:\windows\yvlcylhcvkirxsrsexc.exe*."
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2120
    • C:\Users\Admin\AppData\Local\Temp\azrkixvsneepxuvymhonf.exe
      "C:\Users\Admin\AppData\Local\Temp\azrkixvsneepxuvymhonf.exe" .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe
        "C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe" "c:\users\admin\appdata\local\temp\azrkixvsneepxuvymhonf.exe*."
        3⤵
        • Executes dropped EXE
        PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Safe Mode Boot

1
T1562.009

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\rzacjhouyyhbsyiurvltuwdbio.sbv
    Filesize

    272B

    MD5

    37d7be0b3a89248433fcb778f6793e38

    SHA1

    3d3119dfa8247918c587735b9f6e87852bbc0a02

    SHA256

    4c35e957dc4d3e0c62105db9a3ce98689ec2efce44fb87907b4dba39526ae47e

    SHA512

    b820a88b85e08746896cc5b6876e2120a8253779c4a4f8db824d650c4635c057dfc0011abb0a24d34a20b268748185ddbbc2ad7aae9d0db8f3e2cfe91dff760e

    Download Submit

  • C:\Users\Admin\AppData\Local\slxkcldujuotvmhembcvhumvneteydfwrowlm.rew
    Filesize

    3KB

    MD5

    28b5db244faba07d0744b834106ed237

    SHA1

    2887f1fb265bf87b58172cf0454a99ce8621e106

    SHA256

    429be822c814e837111a18bb137dfafcfeb648a1cf26999476a9397dbe2395bf

    SHA512

    e06fbbf4399a59945f81380c23eff99f3093dd970c3024842f540cccc3a9aced4b66c3e06d4bc0f2bbdf130f701283c33bd3428af765b41e2f9e1c2f9cf4a702

    Download Submit

  • C:\Windows\SysWOW64\njyojvqkcqnvaussdv.exe
    Filesize

    600KB

    MD5

    8e0598bce0b73645c97c9f7db2559c67

    SHA1

    bc9a5043bf0c7ea5f476f02b350d700c333b773f

    SHA256

    126804dd7e7c5b137beee74e61e9be1bda1f98237d47653e27a5d84838d221dd

    SHA512

    54f62747968fdfb5a136947c70e49f30795f4ceba86aeb9ed2789e82c38c3be89e5305b2678ccf7bd88b898bfc3c38de8efc8f44fa1c7a464defb61133044b31

    Download Submit

  • \Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe
    Filesize

    320KB

    MD5

    5203b6ea0901877fbf2d8d6f6d8d338e

    SHA1

    c803e92561921b38abe13239c1fd85605b570936

    SHA256

    0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

    SHA512

    d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471

    Download Submit

  • \Users\Admin\AppData\Local\Temp\yjnscdn.exe
    Filesize

    684KB

    MD5

    c3d84d42ecbc19a1fd12ca95f498dc13

    SHA1

    5248e74f4add028dfc0f98a0b08c124cc3518e4d

    SHA256

    3350a923075fe3f22ea13c353613e7c1502f6bf9c2809a3f05f39394b3f21691

    SHA512

    45a3a62056b295222339e1b8f24f6443baaaba66c128d8c6e0835f0efb935ba3c108e8a6385e657ef70f7517773f57a2e46cc295a22b43220e4e6e106cb4222e

    Download Submit