Overview

overview

7

Static

static

3

68f27fef6a...18.exe

windows7-x64

7

68f27fef6a...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 23:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    68f27fef6ae40ee58fd68f9a2bb61df2

  • SHA1

    94cd446e5068a3c2f6570878f301d6a68ac1a152

  • SHA256

    6679abb38295e55098a0fd5051a38359e4806db5b324653dfb3c6e34bc9437be

  • SHA512

    bdab9818a73087ecfdacf52e23cbc7208611e7cf80ba3ffabd8e63f3218c5845efbfecc2d61b47bf3acb5a8432d08730d0f8b461ffee408a373df74ca502dbe3

  • SSDEEP

    384:kYn8/UNkGbFwf/uPyUZQpFWuWaF59tQxWO2xzVsjnlgQv02HCSr:dsGkGbFwHyyUyH59rJxunL02iS

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\68f27fef6ae40ee58fd68f9a2bb61df2_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\68F27F~1.EXE >> NUL
      2⤵
        PID:536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Fonts\MbsV2QQJe.fon
      Filesize

      16KB

      MD5

      1cf2f002ea7ab9eb6957191a7cfee864

      SHA1

      8950775b27dd0b1ddd49afa841cce6a867fc9b09

      SHA256

      34a239da585600b78869180560496b4894655ed96e45872f42954122691206c1

      SHA512

      23eb5a82e49a2264484c740ea6f1f1ff7456478770f539017f12f1542b757712db53de244c4fb6865cfa6fbfd8aaab85ede6c0e3d79b9470cf435e43ab872aff

      Download Submit

    • memory/2808-6-0x0000000010000000-0x0000000010010000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2808-8-0x0000000010000000-0x0000000010010000-memory.dmp

      Filesize

      64KB

      Download