Overview

overview

10

Static

static

3

JaffaCakes...e8.exe

windows7-x64

10

JaffaCakes...e8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    3s
  • max time network
    3s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 20:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_9759f528df016abbf34917f4c3f0bce8.exe

  • Size

    561KB

  • MD5

    9759f528df016abbf34917f4c3f0bce8

  • SHA1

    68defa8e0c7d9585ebaf2aa40f63d05c64c35fde

  • SHA256

    652e9328a0cf9053848fb72390ca8381e6c543a109932763caf4e60422779836

  • SHA512

    18735927306635ef9b552a79b1bb4e964cc9bd7f6f56a5cfef635b659276c2923d50dee19ae938291165abac389caad660c99e18367333ec945b51cb91e87286

  • SSDEEP

    6144:GKEGlVcJboOtGY8q75yKC2qJDrNRlpwPBYgZ9fVU93eJwN6QFbSpO4XcA2n4aA8E:GKr3QboC9qLGKgZKe4HYpHvcbT

Score
10/10
pykspadefense_evasiondiscoverypersistenceprivilege_escalationtrojanworm

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Pykspa family
    pykspa
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Detect Pykspa worm 3 IoCs
    worm
  • Adds policy Run key to start application 2 TTPs 3 IoCs
    persistence
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 1 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 5 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9759f528df016abbf34917f4c3f0bce8.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9759f528df016abbf34917f4c3f0bce8.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\xencqtkmhox.exe
      "C:\Users\Admin\AppData\Local\Temp\xencqtkmhox.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_9759f528df016abbf34917f4c3f0bce8.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2088
      • C:\Users\Admin\AppData\Local\Temp\nnxfgq.exe
        "C:\Users\Admin\AppData\Local\Temp\nnxfgq.exe" "-c:\users\admin\appdata\local\temp\jaffacakes118_9759f528df016abbf34917f4c3f0bce8.exe"
        3⤵
          PID:2860
        • C:\Users\Admin\AppData\Local\Temp\nnxfgq.exe
          "C:\Users\Admin\AppData\Local\Temp\nnxfgq.exe" "-c:\users\admin\appdata\local\temp\jaffacakes118_9759f528df016abbf34917f4c3f0bce8.exe"
          3⤵
            PID:1792

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      3
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Hijack Execution Flow

      1
      T1574

      Executable Installer File Permissions Weakness

      1
      T1574.005

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      3
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Hijack Execution Flow

      1
      T1574

      Executable Installer File Permissions Weakness

      1
      T1574.005

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Hijack Execution Flow

      1
      T1574

      Executable Installer File Permissions Weakness

      1
      T1574.005

      Impair Defenses

      1
      T1562

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      5
      T1112

      Credential Access

      Discovery

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\crqndcurighyrqobcoqfe.exe
        Filesize

        192KB

        MD5

        5bd2865298d02926fd9fe7215e2282aa

        SHA1

        145e379cf5f96f6b67067b6aeb425dbc1b83f3ca

        SHA256

        6992fec5af6c31cc32a18a7b9ac87c0f0ad99efb3d0c1ccd25279c2cd469a582

        SHA512

        36105c8fdf134729530f37ccf7b2f52521d7f96e5ecef138db72ad84aa3a7018b8a80f4b78cbe457f6d8d8d390eac4a938090c2c49a9807a8d91e9d298263f58

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nbzvkizvliiyqolxxijx.exe
        Filesize

        99KB

        MD5

        9a810c02eedf0c5a7471914ab15744f8

        SHA1

        6ae0aed63cac4411856283095a4b1c6cc5d3665c

        SHA256

        0987f4ec52ae64a47148da2a934284553607a4bb07c80de98fbcd3636629b42d

        SHA512

        9cab22f8b4788479b2fc9c5beb690826a7962ba9dbdfd19312540cdef8b7910416dee2b1b609055ca58f783ecaef5947dca3f513b5e8a59f5105b145025c17f5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nnxfgq.exe
        Filesize

        640KB

        MD5

        df76437b378c9057bd67f9b856041717

        SHA1

        a69291d3f8b700145adfcea3f363dcebdfecf81e

        SHA256

        9527941c90079148738f757789037f1f2c1dfdc99ea4343a377eb09eadf5dfe5

        SHA512

        7bc9df6a4bca8a9d0a3cf9cdf0b7c092f01581d1c52912fa3479321733711c0e0eb9bacd85655d094698f109fc5e65be3e6ab956b478ed734b1698dcfa50cad0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tjjhyyrphgiauuthjwzppn.exe
        Filesize

        256KB

        MD5

        34ae9264ee64831ccda5a751c2ebcb35

        SHA1

        2d642e3ed755c362b55f378e8e471605b1026e37

        SHA256

        71817a8c4cffc036b650fcb72bb48eb952097992bf222f96bddcd2ebb016c2ae

        SHA512

        816cd4e79aedc3b74d7e90b229a918b1cbf47a3dfcb538c16e3dbdb430ad171d85e3279cd1a94c14b62c88a9975c19f4dfb308c899f41492761050b0485cc885

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\xencqtkmhox.exe
        Filesize

        320KB

        MD5

        1a1f85b9d526c05e3137e6a5b6fba5cc

        SHA1

        cb40c224a2fc63413816434eea00b4317f41828e

        SHA256

        413835d7083d408533d4e79bfb2c0e88b8e4f2ae6388af0beda752fb4a68158e

        SHA512

        3e6b315d07cb2aa1864b7b749381a70c4a7393a9ddf67698cd23698e0d173c28e80047beb2b105624f01ce172cb14c8aefb59acb7a026a63066ada6087f88d0b

        Download Submit

      • C:\Windows\SysWOW64\pbxreapjxsqeuqlvtc.exe
        Filesize

        561KB

        MD5

        9759f528df016abbf34917f4c3f0bce8

        SHA1

        68defa8e0c7d9585ebaf2aa40f63d05c64c35fde

        SHA256

        652e9328a0cf9053848fb72390ca8381e6c543a109932763caf4e60422779836

        SHA512

        18735927306635ef9b552a79b1bb4e964cc9bd7f6f56a5cfef635b659276c2923d50dee19ae938291165abac389caad660c99e18367333ec945b51cb91e87286

        Download Submit

      • C:\Windows\crqndcurighyrqobcoqfe.exe
        Filesize

        128KB

        MD5

        6022527189655664e77156505582c428

        SHA1

        fb40b79cd23b570a309f89e2f7c826e5f8cd390a

        SHA256

        732655bb8e3debfdf0447eaaf65f11c90df1a60c908d504ff221a45caa37780f

        SHA512

        2bb15df9e48a00d473593243c2e0476e954d6f19058b0413c73a4c849716745522882e7347255c9c1e8be6e31e7680ad78d95e147f18b377366807256a8a408a

        Download Submit

      • \Users\Admin\AppData\Local\Temp\nnxfgq.exe
        Filesize

        704KB

        MD5

        831aa76c51a3df4f31c5150644e63b2c

        SHA1

        2ba3a56da97ea0d65f26ee573a523ca521b5b068

        SHA256

        1d6dc50289ad688267008126d1ee77f300e286d6ff60f1958f529a9e38daa808

        SHA512

        d1efb0ec114beb9558cdab16689653de28e8369338ea1d9bc21e4ad5408b1e72010b8250458add5ed4f6bb79d0e9b66478ed35468fb3219531fdde47f7e88371

        Download Submit