Overview

overview

7

Static

static

3

186b2a80e5...18.exe

windows7-x64

7

186b2a80e5...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 02:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    186b2a80e5c20d2c0fd77b24ba36dde7_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    186b2a80e5c20d2c0fd77b24ba36dde7

  • SHA1

    d261c944359f842c34bf0b72697d580ea6a4a372

  • SHA256

    ea1b3fdd68a2b5827e7c4b8548a553cc9df1f5d8dba3335b2c84b1679027722f

  • SHA512

    5177cc41c32f3c731feca63fab78125370f9a09ab3e04ac51d9facca3883f9ae94e365a75f6e89576408336476c23d8b35c262886b9fd0e442f5ec1f0edada1c

  • SSDEEP

    24576:U2tRI9/1APmu085qJYb0BmBJ1UIEqLM7rwM+vW0FMteag8tU0vimIA+sIG+rL/u+:nI8wNBm1as+ib6gagSUk3zxori+

Score
7/10
persistenceupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\186b2a80e5c20d2c0fd77b24ba36dde7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\186b2a80e5c20d2c0fd77b24ba36dde7_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\p05.exe
      "C:\Users\Admin\AppData\Local\Temp\p05.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4404
    • C:\Users\Admin\AppData\Local\Temp\CFÓÄÁé͸ÊÓ¸¨ÖúÍø°É¼ÒͥͨÓÃ͸ÊÓ°æ0801-1.exe
      "C:\Users\Admin\AppData\Local\Temp\CFÓÄÁé͸ÊÓ¸¨ÖúÍø°É¼ÒͥͨÓÃ͸ÊÓ°æ0801-1.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" www.288wg.com
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1216

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          471B

          MD5

          fa34ecb8815a2d98849888cb1cdbf38b

          SHA1

          84fd0e04586009efb3683c98da8d9aa41487cd42

          SHA256

          5077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be

          SHA512

          ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          404B

          MD5

          964c5d8ffa8987fea87acc246847e31a

          SHA1

          75ac6da094f19a6ae5cfd4ad3c556731765362de

          SHA256

          a4bff002e7dd9b78ba8c711cb07c18f50a8d4779b83fc0653528d3c11c652ba8

          SHA512

          443c3eb4ec0f8b45048957bfc0a6c8fb3606dac0e50f957c5a45a689bf842a104234c49eb75ffd4954cac7db29eec5ca67c1a62ef47d9c8183a6aab6d6005af2

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6TQEXKX3\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\CFÓÄÁé͸ÊÓ¸¨ÖúÍø°É¼ÒͥͨÓÃ͸ÊÓ°æ0801-1.exe
          Filesize

          2.3MB

          MD5

          dda546e1af9d06be22f297f9002c3ddf

          SHA1

          b579543d54b3b896e9b36304303b837e4ebe52d7

          SHA256

          186425e746ce8dc73aab12ff95db64ff5842eca4f7b1ec4ed18008a5c626d860

          SHA512

          0ba778bc4d1d94c58672fa15820abf8e1d86aae3683aefcee4ff07e72913010c8722e99ba37acb4cfc2c67ac4e191e082db47e04da493b0157e21eadbd14ddee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
          Filesize

          86KB

          MD5

          147127382e001f495d1842ee7a9e7912

          SHA1

          92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

          SHA256

          edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

          SHA512

          97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\p05.exe
          Filesize

          20KB

          MD5

          2fdf86b42ec2ca655aa5b94392d40856

          SHA1

          66bb7a6591ffca75ec19df000d4ff36f60066a3a

          SHA256

          489be3a7e03abe4741b12eebf1c3175fdd4cf3ec726a55aaaa74b86cd3eeb4e5

          SHA512

          9d538b29b8ac16064d4b1d25e7e60a9870a655cd1bcc18846fd90b5b348462cfd04610cc9dd68cba8a6a05b3e44cbe7f2ca350408b789a7cb7ce624a89940dfd

          Download Submit

        • C:\Windows\SysWOW64\Cao.ime
          Filesize

          52KB

          MD5

          b60da4e2e5aceba3ce3d87ee2cd872ee

          SHA1

          9bbdbf1f3ce2c000a86e0473da756a4b1031db41

          SHA256

          b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

          SHA512

          664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874

          Download Submit

        • memory/2740-25-0x0000000000400000-0x0000000000517111-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2740-0-0x0000000000400000-0x0000000000517111-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/4404-12-0x0000000000400000-0x0000000000405AA0-memory.dmp

          Filesize

          22KB

          Download

        • memory/4924-32-0x0000000010000000-0x000000001003D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/4924-44-0x0000000005570000-0x000000000557E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/4924-33-0x0000000010009000-0x000000001000A000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4924-34-0x0000000010000000-0x000000001003D000-memory.dmp

          Filesize

          244KB

          Download