Overview

overview

10

Static

static

3

05f95d3cf3...18.exe

windows7-x64

10

05f95d3cf3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 12:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe

  • Size

    484KB

  • MD5

    05f95d3cf36891fc733800f3b3ffbfb4

  • SHA1

    8897bcc054911642e637028acc5fa8ecafe517fb

  • SHA256

    5079781bf327d46ca28fd70481c15bfb7d12b56f98465acae45759be47e424b1

  • SHA512

    e5a6ffb1c6af27f0a9c6d6b7a10fecb406e268e0c4af6fadfb2e0e2a11f1e5577a72cb46c2046475af900a955f7969bd6f8e392d5cedf70a2a981d761288361f

  • SSDEEP

    12288:XoUld/f2I9JECdYW4/e4Pii15XZSAmKjlafbdDNUQ:X92ILECd0R15XZS3QafpDNUQ

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\LB9c4j3K.exe
      C:\Users\Admin\LB9c4j3K.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Users\Admin\qieirox.exe
        "C:\Users\Admin\qieirox.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2656
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del LB9c4j3K.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:460
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2388
    • C:\Users\Admin\aahost.exe
      C:\Users\Admin\aahost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:444
      • C:\Users\Admin\aahost.exe
        "C:\Users\Admin\aahost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2180
    • C:\Users\Admin\bshost.exe
      C:\Users\Admin\bshost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:1812
      • C:\Users\Admin\dyhost.exe
        C:\Users\Admin\dyhost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4152
      • C:\Users\Admin\ekhost.exe
        C:\Users\Admin\ekhost.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del ekhost.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1080
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:840
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
      1⤵
        PID:1452

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\LB9c4j3K.exe
        Filesize

        212KB

        MD5

        fa0eb2a8b561ea9afc6a51709ff0d7de

        SHA1

        4ef5265f5b5bb1a4857e7668f132405c799da155

        SHA256

        99ecfb1bb7cdb1e8dd609e60b10d5346b90284172c854b6234631212dd501c4f

        SHA512

        0e8b194cb0e65429b84ac32a0fa131d072f7f425804df192d7a90a7ec6eb7ce9991716ce5a9ca3bcd106181076832d5fa7d6f9cbe67fc80a427ef7980beb75c6

        Download Submit

      • C:\Users\Admin\aahost.exe
        Filesize

        140KB

        MD5

        93ea44e078cb0477614729636866a84b

        SHA1

        f9752413d48fd98a77cfce8fff04a7a0d72c26d8

        SHA256

        c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27

        SHA512

        351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113

        Download Submit

      • C:\Users\Admin\bshost.exe
        Filesize

        260KB

        MD5

        bbc0a2fe1284778896b57ffc5701aefa

        SHA1

        6b9a0106b82c63265936ce728a858d258c8f6b14

        SHA256

        92fad55bc5c7438d0f36501581b4b958efba2fbe5db02b97093a79b8a19645a0

        SHA512

        8a17a1ed99a99a270191684b0337836531934b8717e78481815fd18767a172e6d7cf89488926dd2ea1b9e9ccaf53afd29c6925beaeb2fa7fa918be0e416be930

        Download Submit

      • C:\Users\Admin\calc.exe
        Filesize

        764KB

        MD5

        e381b04abf596ed1573154cd41f418dc

        SHA1

        2ad1df7bebf1e4c0715adbf76c8c14b9162edf2e

        SHA256

        02b08664fcc196f15ff0e33e7ed43e9e78af7b564e3f7c5388dd7d0267905fe6

        SHA512

        44307e60bdc804b3abe710a21e2268960dcc9d29671cf8ce723e40721b6b38ae338c49cd1b9cfd4fa8fa4f644cc80414baeb70f136f39f73833f8373f8180858

        Download Submit

      • C:\Users\Admin\dyhost.exe
        Filesize

        48KB

        MD5

        d46eb4bf816ed9978636de7955245323

        SHA1

        c474df60a83302e0d010d11dcebd7cdb3cc22866

        SHA256

        2ae9b936feeade89c9074c379efedd21d15a1cf247207afe5381f437e41ca4bd

        SHA512

        e46a604a96345b1b6800cb22c8c870dfa62dbdd8bd5b6ff43ddce9b080d1af180db498dad23561c0116b4dadbc44617b26840e67bc0afde01439e4c70632d7ef

        Download Submit

      • C:\Users\Admin\ekhost.exe
        Filesize

        24KB

        MD5

        9fe0e5252dc24fc1788b0d8b26026807

        SHA1

        21e3063a0fac1157b9707861048c5f7fbd070ceb

        SHA256

        9c99c968d969c2d5c1570c6066957d726bc19ffe9e0562242ce1bf79514c1b40

        SHA512

        613f5c821dfcef8124ecb7c9b118cda14be4d72a26f1a21ffde81c4d8aae4f315740d66c298e5963b0647f0ecd9e2d63d9bbb8df4e0c731019896e7ac0391d5c

        Download Submit

      • C:\Users\Admin\qieirox.exe
        Filesize

        212KB

        MD5

        6f5540604f4931ec35e3ec5360a540ae

        SHA1

        2bca36efa3a9a93d832af66ae2ed560af8ebdaaa

        SHA256

        eb76daf23fdf03719078e564742090365e5ff937275cb34fbecae2dd070051a0

        SHA512

        0f9b7d54d4b04c0d80d96e5662bc121823c40dd7950b42dbb7258f7e4555b5c8d54c3939eee22e44e80eb7329f70f2a1bd909ee0750e044d7767a1636b587fd5

        Download Submit

      • memory/1504-60-0x0000000000400000-0x0000000000444000-memory.dmp

        Filesize

        272KB

        Download

      • memory/1504-57-0x0000000000400000-0x0000000000444000-memory.dmp

        Filesize

        272KB

        Download

      • memory/2180-47-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2180-50-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2180-51-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2180-52-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download