Overview

overview

8

Static

static

7

0ff31c736f...18.exe

windows7-x64

7

0ff31c736f...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 23:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0ff31c736f57dee1ac5efdaf286e3e4c_JaffaCakes118.exe

  • Size

    36KB

  • MD5

    0ff31c736f57dee1ac5efdaf286e3e4c

  • SHA1

    7745de3771bea0fde3d3a76d215dcbed3877aa60

  • SHA256

    7c3aaf280b08134e4d45bc3d439c42a5871af7be6aa4528f302b258ffa078136

  • SHA512

    7dad6d891f25549ba690cd4aad2ad08fdfe41704955177853df51f33f5b2865f2f706460faa7dcede3ce0b620c0b0b5c126d5f995d95c0bcc074d888f906db8d

  • SSDEEP

    768:zIaTp5pmfLBCj/WDoCnrtJ/OH12WLS+rffDVIvQ:zIkpHy42nrtxOH12M3ffD3

Score
8/10
persistenceupx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ff31c736f57dee1ac5efdaf286e3e4c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0ff31c736f57dee1ac5efdaf286e3e4c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\ccdata.exe
      "C:\Users\Admin\AppData\Local\Temp\ccdata.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2912
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1304,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
    1⤵
      PID:4316

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\ccdata.exe
            Filesize

            22KB

            MD5

            bf97d5d2c64114405c24b8cc8d243614

            SHA1

            9fd0dd4e06bf93d88655e51b9c6d08480e85c8ed

            SHA256

            1054635e21471a9c97ff31c5d21c22e3812d6160d33acb2cbdd9124b83d21ad8

            SHA512

            63ecf6af52eb5bf0f6301de699efbea309ecdeb90966631db22a792f67d0d8a573da67a322eee460e6fb22df8e784a7d022104ec450bb6ff0248f6683a2fc9b9

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\kisup.dat
            Filesize

            16KB

            MD5

            219394ebb12624755e13e8c1f6da342c

            SHA1

            01c18e9c839263e3baa7f90688543a100cc407ee

            SHA256

            153dc55887a986eb52a8be9008342a66b7b60b8ece2b5e81138309210153d142

            SHA512

            50dffcddb5fef885388b7041789ec4c05964543d42d0777f3f7f65bcfa117513173a47488e30ace6355def928806492d7c04366343173b492b7bd8d3c148e3e7

            Download Submit

          • memory/2856-0-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB

            Download

          • memory/2856-25-0x0000000002DF0000-0x0000000002DF6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/2856-27-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB

            Download