Overview

overview

10

Static

static

10

7eed4997ee...18.exe

windows7-x64

10

7eed4997ee...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2024 00:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7eed4997ee6c4849897eb209a77fd7e6_JaffaCakes118.exe

  • Size

    5.6MB

  • MD5

    7eed4997ee6c4849897eb209a77fd7e6

  • SHA1

    7782165d630383a1989d7bd490d867950427582c

  • SHA256

    073a6467004030962b905321bf0ab10474e2dad822256dcf1f38e70a5ce3056f

  • SHA512

    7cedd5073c28dd913a2a07ad49d2ea88716d25c40bdee1357eaad9c6bd884097198af0989e9d5c3ae38a3f4e834ae4a0ba3c6f2c4a69e0ba794213143e0c8ca6

  • SSDEEP

    49152:9CPZG2y/zWox8ckgfCXZk2DKTUpLxfaA/nKMTOV9ejPjb6OUlMXhoG1Lob1b+QTh:Wyt3fCXZJKlA/ndXh51YcyDEe

Score
10/10
gluptebadropperevasionloaderpersistence

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 1 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7eed4997ee6c4849897eb209a77fd7e6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7eed4997ee6c4849897eb209a77fd7e6_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\7eed4997ee6c4849897eb209a77fd7e6_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7eed4997ee6c4849897eb209a77fd7e6_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3668
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4100
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2776
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe ""
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        PID:4072
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
    1⤵
      PID:2576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\rss\csrss.exe
      Filesize

      5.6MB

      MD5

      7eed4997ee6c4849897eb209a77fd7e6

      SHA1

      7782165d630383a1989d7bd490d867950427582c

      SHA256

      073a6467004030962b905321bf0ab10474e2dad822256dcf1f38e70a5ce3056f

      SHA512

      7cedd5073c28dd913a2a07ad49d2ea88716d25c40bdee1357eaad9c6bd884097198af0989e9d5c3ae38a3f4e834ae4a0ba3c6f2c4a69e0ba794213143e0c8ca6

      Download Submit