53cfb8f99a1a8c56b3469c384b93df9d8c7eedde059e7e72560a37287ca22e86

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e80223cc7aa539d07a322f37b0ad56e2_JaffaCakes118.exe
Size

26KB
MD5

e80223cc7aa539d07a322f37b0ad56e2
SHA1

67dd6137c4ef925c52c28dca74246d43615ebeb1
SHA256

53cfb8f99a1a8c56b3469c384b93df9d8c7eedde059e7e72560a37287ca22e86
SHA512

472d7447c46d434de4ea6035d5c098d43f8a789456855f8fb07755f98944713e5bb589fda6bfe7adad1e1c49978c5f8dd646c377e5e9fd09b9d79394f1fa6d27
SSDEEP

384:Dyujasj+wm8nIGSIvAZAlpM/Nyd51LhoxMrs7CGR3NNuZtwAj8BqtP1Z6nPlas:+ujaQ+Cn/SIvAC0Nm5ZWxIiI2C80EnPP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000010000-0x0000000000024000-memory.dmp	upx
behavioral2/memory/5068-5-0x0000000000010000-0x0000000000024000-memory.dmp	upx
behavioral2/memory/5068-6-0x0000000000010000-0x0000000000024000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Passepartout.exe	e80223cc7aa539d07a322f37b0ad56e2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://grounydxmanager.com.reality.net.my-content.net"	e80223cc7aa539d07a322f37b0ad56e2_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

C:\Users\Admin\AppData\Local\Temp\e80223cc7aa539d07a322f37b0ad56e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e80223cc7aa539d07a322f37b0ad56e2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer start page
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:8
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5068-0-0x0000000000010000-0x0000000000024000-memory.dmp

Filesize
80KB

Download
memory/5068-5-0x0000000000010000-0x0000000000024000-memory.dmp

Filesize
80KB

Download
memory/5068-6-0x0000000000010000-0x0000000000024000-memory.dmp

Filesize
80KB

Download