Overview

overview

7

Static

static

3

68f27fef6a...18.exe

windows7-x64

7

68f27fef6a...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 23:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    68f27fef6ae40ee58fd68f9a2bb61df2

  • SHA1

    94cd446e5068a3c2f6570878f301d6a68ac1a152

  • SHA256

    6679abb38295e55098a0fd5051a38359e4806db5b324653dfb3c6e34bc9437be

  • SHA512

    bdab9818a73087ecfdacf52e23cbc7208611e7cf80ba3ffabd8e63f3218c5845efbfecc2d61b47bf3acb5a8432d08730d0f8b461ffee408a373df74ca502dbe3

  • SSDEEP

    384:kYn8/UNkGbFwf/uPyUZQpFWuWaF59tQxWO2xzVsjnlgQv02HCSr:dsGkGbFwHyyUyH59rJxunL02iS

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\68F27F~1.EXE >> NUL
      2⤵
      • Deletes itself
      PID:2560

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\Fonts\MbsV2QQJe.fon
    Filesize

    16KB

    MD5

    1cf2f002ea7ab9eb6957191a7cfee864

    SHA1

    8950775b27dd0b1ddd49afa841cce6a867fc9b09

    SHA256

    34a239da585600b78869180560496b4894655ed96e45872f42954122691206c1

    SHA512

    23eb5a82e49a2264484c740ea6f1f1ff7456478770f539017f12f1542b757712db53de244c4fb6865cfa6fbfd8aaab85ede6c0e3d79b9470cf435e43ab872aff

    Download Submit
  • memory/2548-5-0x0000000010000000-0x0000000010010000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2548-7-0x0000000010000000-0x0000000010010000-memory.dmp
    Filesize

    64KB

    Download