Overview
overview
10Static
static
32239fcbdac...18.exe
windows7-x64
102239fcbdac...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Setupres.exe
windows7-x64
9Setupres.exe
windows10-2004-x64
9ipras.vbs
windows7-x64
8ipras.vbs
windows10-2004-x64
8Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 23:36
Static task
static1
Behavioral task
behavioral1
Sample
2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2239fcbdac9582e1a379dc39ca1e4dd1_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
Setup.exe
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
Setup.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
Setupres.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Setupres.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
ipras.vbs
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
ipras.vbs
Resource
win10v2004-20240419-en
General
-
Target
Setupres.exe
-
Size
2.0MB
-
MD5
b00f36abdbc0edb4729ae72ed388e965
-
SHA1
a1bf243bda51006cf4c8b9ee1fdcffb206058973
-
SHA256
5e64432c3afc95cfda49aa9479fd66efb8d7ef9812a2acb3fa9a0f536a2e5db9
-
SHA512
8dd8e5d9d6ad4a5515ae178f27e4878ddab3b8cf8786177cac91719517a959fba30cc7d93eb0eff9d1d71d097dbbdf07684fd8b077e144927079db8b8d1f5bb3
-
SSDEEP
24576:w1s2njjVylkYLbXqdA695Od5VsyVwEP7x5ATlTHrt1iXeS08wn5cvcb:osUnV4LjqX5E5TwEPbATlXiX/08k
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setupres.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setupres.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setupres.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setupres.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setupres.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setupres.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation Setupres.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Setupres.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Software\Wine Setupres.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setupres.exepid process 4636 Setupres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Setupres.exepid process 4636 Setupres.exe 4636 Setupres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setupres.exe"C:\Users\Admin\AppData\Local\Temp\Setupres.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ergfsdcsv.exeFilesize
14KB
MD5f42da63fef779cf11623ec8df390a346
SHA148c3d730542d3329dcb356ebfac96908c3f54c47
SHA2565ce31c491eaf8dd5bb30f9264a89d93144663751d75c151de4ea89b3fb88087e
SHA512beaafcd43e33d7f39a23becf8e0ef42fa0ee50b1fc359ba40858abbf5cb96ac8fdb3057757fcf4c21d6d772323e5e1a2932e31a672a5a4db97bf86c6c2986b2b
-
C:\Users\Admin\AppData\Roaming\rgvsdc.exeFilesize
14KB
MD5bee7c3df7c9777bd01ac1a4aa4441413
SHA1b10d421be1c20e93e0a05abbbf2758a2fd895baf
SHA2564a17c7be5800888b9bbcc9bce574f0e8ea9553fa4f8f107018da4c5ee35a0127
SHA5127c982e1ac2ccd975a8179cde9c419b101d71b78cd50a0e044b7ea39ae571d17c7eb8f94c0c5cb62f6e65f6f79e74e4e6e8ec22bbaae27e7e59dc0941fa184d54
-
memory/4636-20-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-61-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-9-0x0000000009F90000-0x0000000009F91000-memory.dmpFilesize
4KB
-
memory/4636-8-0x0000000009E30000-0x0000000009E31000-memory.dmpFilesize
4KB
-
memory/4636-7-0x0000000009E10000-0x0000000009E11000-memory.dmpFilesize
4KB
-
memory/4636-6-0x0000000009E50000-0x0000000009E51000-memory.dmpFilesize
4KB
-
memory/4636-5-0x0000000009E20000-0x0000000009E21000-memory.dmpFilesize
4KB
-
memory/4636-4-0x0000000009E70000-0x0000000009E71000-memory.dmpFilesize
4KB
-
memory/4636-0-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-11-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-12-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-13-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-14-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-15-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-16-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-17-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-18-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-19-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-3-0x0000000009DC0000-0x0000000009DC1000-memory.dmpFilesize
4KB
-
memory/4636-10-0x0000000000401000-0x000000000045D000-memory.dmpFilesize
368KB
-
memory/4636-31-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-27-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-28-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-29-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-30-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-26-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-32-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-33-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-34-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-2-0x0000000009E40000-0x0000000009E41000-memory.dmpFilesize
4KB
-
memory/4636-45-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-46-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-47-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-48-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-1-0x0000000077074000-0x0000000077076000-memory.dmpFilesize
8KB
-
memory/4636-60-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-21-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB
-
memory/4636-62-0x0000000000400000-0x000000000091E000-memory.dmpFilesize
5.1MB