Overview

overview

10

Static

static

7

23338c3da2...18.exe

windows7-x64

10

23338c3da2...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23338c3da2132b5349bd88dcdf7513cf_JaffaCakes118.exe

  • Size

    7.3MB

  • MD5

    23338c3da2132b5349bd88dcdf7513cf

  • SHA1

    7592d91215e56be673e748f342fa396a3451d73f

  • SHA256

    c4520737d744b8c9efaaf6360d596b523c7e0d8bb18ef9a33219f41011e318b0

  • SHA512

    1854ae184b1cfe41dc12dca75cf87c4e66e35d898c1f4bbdf6b3372499a447fcb90bb377fd03e0a06c8f139e701b231265d6518d4128935458fcc331bb0e60ae

  • SSDEEP

    3072:3Bx+1K6Hr3bxFNBAg9+FYRXZIOFtylC5CUJBYYhmDWQx68m5KoutnV:30f7DITC5CU7Y5fx6x5KoSn

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables taskbar notifications via registry modification
    evasion
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\23338c3da2132b5349bd88dcdf7513cf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\23338c3da2132b5349bd88dcdf7513cf_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:4592
      • C:\Users\Admin\D979EE043E33DB5D\FA72E9.exe
        "C:\Users\Admin\D979EE043E33DB5D\FA72E9.exe" 11C49CCB
        2⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Sets file execution options in registry
        • Drops startup file
        • Executes dropped EXE
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:5024
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          3⤵
            PID:4468
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        1⤵
          PID:4588

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Impair Defenses

        3
        T1562

        Disable or Modify Tools

        3
        T1562.001

        Modify Registry

        12
        T1112

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        3
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\D979EE043E33DB5D\FA72E9.exe
          Filesize

          7.3MB

          MD5

          23338c3da2132b5349bd88dcdf7513cf

          SHA1

          7592d91215e56be673e748f342fa396a3451d73f

          SHA256

          c4520737d744b8c9efaaf6360d596b523c7e0d8bb18ef9a33219f41011e318b0

          SHA512

          1854ae184b1cfe41dc12dca75cf87c4e66e35d898c1f4bbdf6b3372499a447fcb90bb377fd03e0a06c8f139e701b231265d6518d4128935458fcc331bb0e60ae

          Download Submit

        • memory/2044-0-0x0000000000400000-0x0000000000445000-memory.dmp

          Filesize

          276KB

          Download

        • memory/2044-10-0x0000000000400000-0x0000000000445000-memory.dmp

          Filesize

          276KB

          Download

        • memory/5024-12-0x0000000000400000-0x0000000000445000-memory.dmp

          Filesize

          276KB

          Download

        • memory/5024-1873-0x0000000000400000-0x0000000000445000-memory.dmp

          Filesize

          276KB

          Download