Overview

overview

8

Static

static

3

177b1d0ce8...18.exe

windows7-x64

8

177b1d0ce8...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 20:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    177b1d0ce87fe45d6b9d7e7677a51cd8_JaffaCakes118.exe

  • Size

    1005KB

  • MD5

    177b1d0ce87fe45d6b9d7e7677a51cd8

  • SHA1

    b9e85b5fd11fe55bd72560c559372ff47b9f92f2

  • SHA256

    0bf41c72d978ae2c2ca80628539a1359462b5a2047fb10436c06ebf381555d55

  • SHA512

    1c0cf065e1ae5df93c142d406028ed61a9f7ca23c7d36b33722e914f2f24b9007e031d5d6d48253a3e781ec3be3cddd7a4c17dd2641a432a2431056713fd31bd

  • SSDEEP

    24576:I+JbLlFgYA0VzjDAI7sVj6zFO0x+nxjMj7ryXz8WTArs:I4dmYRMc6WzI6+JtAr

Score
8/10
persistence

Malware Config

Signatures

  • Uses Session Manager for persistence 2 TTPs 1 IoCs

    Creates Session Manager registry key to run executable early in system boot.

    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\177b1d0ce87fe45d6b9d7e7677a51cd8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\177b1d0ce87fe45d6b9d7e7677a51cd8_JaffaCakes118.exe"
    1⤵
    • Uses Session Manager for persistence
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\ponto.DLL
    Filesize

    399B

    MD5

    f0161328b321dfcba81d4516524b2781

    SHA1

    c65bdb62b67f4150f94d75fa64788d8f05b13859

    SHA256

    f37e10ca84be6e476d1164eca5b1d104f5dac890f02f5de701c61b86f19a1eae

    SHA512

    273f3bcd6cf80020ac85227184c05d4c901c07e3782e741ee5b8abb63f89171c632725de68f4b015ca902fec4268eaa1101ab8d9b7f592721e08b94a329ff672

    Download Submit

  • memory/3016-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3016-12-0x0000000000400000-0x0000000001F5F000-memory.dmp

    Filesize

    27.4MB

    Download

  • memory/3016-22-0x0000000000400000-0x0000000001F5F000-memory.dmp

    Filesize

    27.4MB

    Download

  • memory/3016-26-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download