Overview

overview

7

Static

static

3

f27ff6d724...18.exe

windows7-x64

7

f27ff6d724...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-04-2024 02:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe

  • Size

    390KB

  • MD5

    f27ff6d72495c5bebe7e3411462dacc9

  • SHA1

    52782e81abe0cee64cbcd91cbfb4e8cc0765ba02

  • SHA256

    e21ca893ffd12b220aa810c7190736b3ffc0a39349613965ca91fcd23c62f725

  • SHA512

    871f241d2eacaaf40992899b82ba9b627baf56779e8c1140f9f092428272740abd525c1228185128b70a05c6d2d87398bca1d625d38b5bec99b57c9d8b5d065f

  • SSDEEP

    6144:3A0dN4AcyOXBVPdez+FzZjsKkSFCiuS77etKvGpE+a/jYoSuOfMeOoxSn7S94EeN:3A0dN4ZjPFZjs95iuS77WaLmlMjz9

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 888
      2⤵
      • Program crash
      PID:5080
    • C:\lF04903OjMfJ04903\lF04903OjMfJ04903.exe
      "\lF04903OjMfJ04903\lF04903OjMfJ04903.exe" "C:\Users\Admin\AppData\Local\Temp\f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 880
        3⤵
        • Program crash
        PID:5012
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2340 -ip 2340
    1⤵
      PID:5100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1036 -ip 1036
      1⤵
        PID:3180

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\lF04903OjMfJ04903\lF04903OjMfJ04903.exe
        Filesize

        390KB

        MD5

        bef18c446e5395446b0c1fffb42ac1fa

        SHA1

        64b407de2046b4512cbee400d3bac657bb93586d

        SHA256

        1a4b619f93f99d001af0b6757a0cbcb60b0676792736399fa029a994ee81f2fe

        SHA512

        384067d3a3b86c0afa44343ee5c46bb1cf6661ab4ab707d5d942ee7cbd3812f1a4b9dd3203d312d65e9cea6f9c05b2a7484007edff96f6c40fa95136ffda6963

        Download Submit

      • memory/1036-82-0x0000000000400000-0x00000000004CB000-memory.dmp

        Filesize

        812KB

        Download

      • memory/1036-83-0x00000000005B0000-0x00000000005B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1036-167-0x0000000000400000-0x00000000004CB000-memory.dmp

        Filesize

        812KB

        Download

      • memory/2340-0-0x0000000002240000-0x0000000002243000-memory.dmp

        Filesize

        12KB

        Download

      • memory/2340-1-0x0000000000400000-0x00000000004CB000-memory.dmp

        Filesize

        812KB

        Download

      • memory/2340-2-0x0000000002260000-0x0000000002261000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2340-164-0x0000000000400000-0x00000000004CB000-memory.dmp

        Filesize

        812KB

        Download

      • memory/2340-180-0x0000000000400000-0x00000000004CB000-memory.dmp

        Filesize

        812KB

        Download