Overview

overview

8

Static

static

3

0559adee6d...18.exe

windows7-x64

8

0559adee6d...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 14:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0559adee6d2b28823e75f5cea8597e8c_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    0559adee6d2b28823e75f5cea8597e8c

  • SHA1

    d72aed249d52d3db35bb4fc15e7a18daa991ff58

  • SHA256

    710bfab151093eb545838df18aa0c90676facf9bf827032ee768fbccd6f663ac

  • SHA512

    6ab02cd01b477a3989346a5c9bca2a60f5ac454722a9502d454ac11ffe20da031590aaac3ed6fc7f2ff16876b9b2a6b31211fe274b44afa483bbeaa51ad98d15

  • SSDEEP

    24576:SX48QE+Uvg7zEKDWsK8R4G51puPU4YyhkhcYcUOAPG1MhZArSPTuwIHiL:SXz+tnRq2mGvpkrYyhkhcY2m1rDCJHc

Score
8/10
discoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 3 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0559adee6d2b28823e75f5cea8597e8c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0559adee6d2b28823e75f5cea8597e8c_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\service.exe
      "C:\Users\Admin\AppData\Local\Temp\service.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Users\Admin\AppData\Local\Temp\service.exe
        "C:\Users\Admin\AppData\Local\Temp\service.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Sets desktop wallpaper using registry
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Control Panel
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\NGGBF.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:576
          • C:\Windows\SysWOW64\chcp.com
            chcp 1251
            5⤵
              PID:2376

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\NGGBF.bat
      Filesize

      195B

      MD5

      26ae5de1fc7a175a47de26542676afa5

      SHA1

      5e1bae414e64cda682f62ba754c05466eaf0be39

      SHA256

      6da086afc12a9b1546c46aae64205f2a90b592ff2211e374aec84214cb270698

      SHA512

      34c200e2d79b7692d5300fa5c48268762e36cc14798d8c265c7782b640a73fa6f9e2eda60ee08f44782ca511e9e8034bc433ba66320c35ae5165d4ff9d487918

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\service.exe
      Filesize

      709KB

      MD5

      574511470840140f41c02e40a383a3dd

      SHA1

      8686793fd36251d610cf4c44dee75767e2df79e7

      SHA256

      d1ba0601fa4f0341773d5c6cf373621c53a79ae1e965f59bef688ee4f702de47

      SHA512

      a38cec5dd41048348136c94d2f8f4ef0965296f844f5ba52f344179cc3fc5e15b2fa570320a406e7f3936d1fb9f003f4e82dd3bc299455a1e1a7b7971b28a18a

      Download Submit
    • memory/2380-22-0x0000000000400000-0x0000000000433000-memory.dmp
      Filesize

      204KB

      Download
    • memory/2816-37-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-29-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-34-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2816-30-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-38-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-31-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-36-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-28-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-27-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-26-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-25-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-625-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download
    • memory/2816-668-0x0000000000080000-0x0000000000081000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2816-39-0x0000000000080000-0x0000000000081000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2816-1316-0x0000000000400000-0x0000000000497000-memory.dmp
      Filesize

      604KB

      Download