Overview

overview

7

Static

static

7

ff608b4827...18.exe

windows7-x64

7

ff608b4827...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    115s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2024, 13:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff608b48277a55c95fbf8615a6098af3_JaffaCakes118.exe

  • Size

    23KB

  • MD5

    ff608b48277a55c95fbf8615a6098af3

  • SHA1

    dbe99ffe62c98fca2a2f4cf4d377d659f3de9159

  • SHA256

    eafc8ad1019ab5050c1d6ca8205667096558f45aa949e5960064098907cf726a

  • SHA512

    f08bb63b89ff4bae5a37214e0a81c5fc777fca53fae457f1e4d431cc910a3959b62e9c356dbdf2dd90c0f1ed0c0a3cb5f1625cf71112ee76a34e323bb698e068

  • SSDEEP

    384:EGUInDfWvVjFtufOjjXgYmFBHHjf/WQSzgM/TqFiFl0abdEGfdxO1b1s:dtnDfMqfwgRjf/WxgMr+id6udxOZ+

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff608b48277a55c95fbf8615a6098af3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff608b48277a55c95fbf8615a6098af3_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FF608B~1.EXE >> NUL
      2⤵
        PID:4168

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\VnTU2WAqUcZA6.dll
      Filesize

      14KB

      MD5

      59338fb2819236dca78f7336fae6105c

      SHA1

      7133a7a45db5c615df659fa9ee6a1160d8c26e51

      SHA256

      196709b08d9589cf508a9a58fbc59cb81ef72d3bf8b56f14f90ca4b40c80a6f5

      SHA512

      7aa028e45611605da8085e587a0776de3136f9102cd8194c47026dfbf6cf950da2618d3543035a3bb78dc8bbc4617289bdc4f5d6412062c4d6e32485bc98ee8c

      Download Submit

    • memory/3812-0-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    • memory/3812-7-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

      Download

    • memory/3812-8-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    • memory/3812-9-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

      Download