2e8c45281d65f80244cecf99b939d4bc506597eb94a9f1c0fe0404c028f42c4f

Analysis

max time kernel
145s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_991d453966f2710887d63540216ff40d.exe
Size

2.7MB
MD5

991d453966f2710887d63540216ff40d
SHA1

42bd94f26e36c5e9a8ee9d9120d4621993f932f6
SHA256

2e8c45281d65f80244cecf99b939d4bc506597eb94a9f1c0fe0404c028f42c4f
SHA512

a32888aae4a4d983f2c691c504c2398175a6055595c9e69c050c94d9dc27ac5087f9aa794e176b4bd91fbb9df9bd9700c4698cf806459482aff0378cdc538227
SSDEEP

49152:acQ/QOxVY6yvunHkq/m2hJcax2EOZYgUjWbb0SdSLrgWQUaRZHJTBJvWempJF+UQ:aD/xxV9ypXw8Rlbpj+NFvJIpsMl

Score

7^/10

defense_evasion discovery themida

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2292	Crypted.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	Crypted.exe

Themida packer 29 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00090000000167e3-8.dat	themida
behavioral1/memory/2292-11-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-137-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-165-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-182-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-181-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-180-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-176-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-164-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-198-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-199-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-292-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-294-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-295-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-296-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-297-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-298-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-299-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-300-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-301-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-302-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-303-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-304-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-305-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-306-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-307-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-308-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-309-0x0000000000400000-0x000000000086B000-memory.dmp	themida
behavioral1/memory/2292-310-0x0000000000400000-0x000000000086B000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypted.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\command	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic\ = "Connect"	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Crypted.exe\""	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Application	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application\ = "mIRC"	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Topic	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cha	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application\ = "mIRC"	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.chat\ = "ChatFile"	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec\ = "%1"	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\ = "URL:IRC Protocol"	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\ifexec	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ifexec\ = "%1"	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.chat	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Topic\ = "Connect"	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cha\ = "ChatFile"	Crypted.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\DefaultIcon	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Crypted.exe\" -noconnect"	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ = "%1"	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\URL Protocol	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\ = "Chat File"	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Crypted.exe\" -noconnect"	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ = "%1"	Crypted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command	Crypted.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\EditFlags = 02000000	Crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Crypted.exe\""	Crypted.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2292	Crypted.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2292	Crypted.exe
2292	Crypted.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2292	2544	JaffaCakes118_991d453966f2710887d63540216ff40d.exe	31
PID 2544 wrote to memory of 2292	2544	JaffaCakes118_991d453966f2710887d63540216ff40d.exe	31
PID 2544 wrote to memory of 2292	2544	JaffaCakes118_991d453966f2710887d63540216ff40d.exe	31
PID 2544 wrote to memory of 2292	2544	JaffaCakes118_991d453966f2710887d63540216ff40d.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_991d453966f2710887d63540216ff40d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_991d453966f2710887d63540216ff40d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\Crypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypted.exe

Filesize
2.0MB

MD5
cdae2ae9d1f43b27ff80ce989a34a906

SHA1
2d509bb047d42f4fda74f6279c1e206155a62b58

SHA256
ecf9f457bbf099155ab96e9971baf0ade765240ae0b7c5ede9262a07415a83fe

SHA512
23cf45b4f76510529eccfca7eeec61c458ea8383c6601593ffe7ef0ca8ffa45f1b677d4076d58113220dbb3d4a32b909aeeeec4304699dc17a560486244707fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\mirc.ini

Filesize
915B

MD5
63a8ac4a048b63b558f816c1d690065f

SHA1
4792709596955c8077d56f18daff771b528e2faf

SHA256
7a69cef7a4af2649fc80b10fb9ca6c1ff0a9a76fea7127ef0ff11571d863a162

SHA512
8ed3628e1f37ed930d75f85a45d213a2209e36a7f8df44a784539acdc49d9d9898b7f109bc59cdb6bb7b8bf05abae90d667b1942c582e68c1fe4641932654197

Download Submit
C:\Users\Admin\AppData\Local\Temp\mirc.ini

Filesize
875B

MD5
a7afc3ee8eb79b3ec537d557067aaa5a

SHA1
5dc296dab63520e831345311aa0d765c41bbe10f

SHA256
48143eadea47adac233d8d1eb536f9992eb04ee2a5f3efc66798279931191df8

SHA512
1083a7af3b67fb8fafae1fa10ae80d799cf3c016ede54938add4520e4c45d472b999764e18616f62e3ddf1bcb9b285328c307f841a33aa7fcc3f8fe3b4da9559

Download Submit
C:\Users\Admin\AppData\Local\Temp\mirc.ini

Filesize
1KB

MD5
8676447d224c426ac3b3c543be96004f

SHA1
e3c8fd8f8f9767d9893c2443b3834ab1c2aaee2d

SHA256
044abb14d5c887535141fe70e1c311a35dce4f509ac05b43fd17006400da35cb

SHA512
bb8684d48e3d3108163a5971553aaae89012268165666363b4ae76bf3deb989ceb9fee42161d97e9b40f5f4b3987693216996f5d5ab7cddd9ef9d30971823703

Download Submit
memory/2292-176-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-292-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-310-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-11-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-137-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-294-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-15-0x0000000000401000-0x00000000004AE000-memory.dmp

Filesize
692KB

Download
memory/2292-165-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-182-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-181-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-180-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-13-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2292-164-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-198-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-199-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-309-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-308-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-296-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-12-0x0000000000A40000-0x0000000000B3D000-memory.dmp

Filesize
1012KB

Download
memory/2292-293-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2292-307-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-295-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-306-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-297-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-298-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-299-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-300-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-301-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-302-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-303-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-304-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2292-305-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2544-2-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

Filesize
9.6MB

Download
memory/2544-0-0x000007FEF63DE000-0x000007FEF63DF000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

Filesize
9.6MB

Download
memory/2544-3-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

Filesize
9.6MB

Download
memory/2544-14-0x000007FEF6120000-0x000007FEF6ABD000-memory.dmp

Filesize
9.6MB

Download