Overview

overview

7

Static

static

3

9f19e67bc1...18.exe

windows7-x64

7

9f19e67bc1...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2024 18:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f19e67bc1ba79171eaf769ccc69b4a0_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    9f19e67bc1ba79171eaf769ccc69b4a0

  • SHA1

    184925df13d02d6a61d33ae17b863c203bffb0b3

  • SHA256

    e51c3c986d69ef7e1e652fa7d79a2f2358815f70276e4e430aba493da98c0c59

  • SHA512

    d95aa2422a1316fc41a7a77574f85924f69369cc9290c71e3a1c3bc7f64307320651b437ab8a03fc263272c0a864eca3780f3e8512535155c24eb863908a57b1

  • SSDEEP

    384:qU4Db7UNU6btwf/uPyk7+1xhgDbhEUmJoYw9U+rfgQ09BjdyBp4yePNMmch2Jvik:oTGU6btwHyy++EhT4oBUUf0BDFM3hqR

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f19e67bc1ba79171eaf769ccc69b4a0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9f19e67bc1ba79171eaf769ccc69b4a0_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9F19E6~1.EXE >> NUL
      2⤵
        PID:4652

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\skcfujQ5EDN.dll
      Filesize

      16KB

      MD5

      9e393de94f24c51d4161dfad546e2cad

      SHA1

      25468289ed97cd1b8eab8b3517b53c1f05ed8247

      SHA256

      a85b0f77bfb57cf74486f9a85921a0673d5e3fc51bcadec71af2c40dbde67135

      SHA512

      83cd51bffaf35ffc1c2cec6843952265b3d3b7072b60382e6742a87d1b75e848454c1f7c301f3e2fb71cb4c6a3e8de02aace10730f1d2df4f95b781f1634482f

      Download Submit

    • memory/2916-6-0x0000000010000000-0x0000000010010000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2916-8-0x0000000010000000-0x0000000010010000-memory.dmp

      Filesize

      64KB

      Download