Overview

overview

7

Static

static

3

19f3dbb512...18.exe

windows7-x64

7

19f3dbb512...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 11:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19f3dbb5124851c4a2cead8606fcf40a_JaffaCakes118.exe

  • Size

    423KB

  • MD5

    19f3dbb5124851c4a2cead8606fcf40a

  • SHA1

    8658ed712d843ab7f574a8df9de8b3f7cbdf19a2

  • SHA256

    43fa64424268d736f48549f5fbdbf704f08f357c4f9f47dce772b0b8ab39e1f4

  • SHA512

    aa58b784a30afa4dfa1afc493ebc868f157450f0e979fbdf959938c50473277fd8ad7e8eb015f34bafc957c566b7bb88602d7a45dba4130b14b40e4f78695a0f

  • SSDEEP

    12288:zlkP801a58gNyPCYCU4zqM8XH2d/Coik6M:GP9wVHQHux

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19f3dbb5124851c4a2cead8606fcf40a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\19f3dbb5124851c4a2cead8606fcf40a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\ProgramData\kAk24512dCbIc24512\kAk24512dCbIc24512.exe
      "C:\ProgramData\kAk24512dCbIc24512\kAk24512dCbIc24512.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3056
    • C:\ProgramData\kAk24512dCbIc24512\kAk24512dCbIc24512.exe
      "C:\ProgramData\kAk24512dCbIc24512\kAk24512dCbIc24512.exe" "C:\Users\Admin\AppData\Local\Temp\19f3dbb5124851c4a2cead8606fcf40a_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\kAk24512dCbIc24512\kAk24512dCbIc24512
    Filesize

    192B

    MD5

    822f89b944cef1934ab9cf703f08094a

    SHA1

    38794d450bab384968fca194605f0756fc274948

    SHA256

    3ab831e1ebe703b0144edd6b4c5104415f26dc915eed661c133b3f493dfd1d93

    SHA512

    9d8f7591d2bd5b60a8683d9be5c8e8ecd5fbf188b84644101b4df4ba737fa631fdbbe58d009e2376eca21ce4f1ffbf3d964208c7dd7d55041eeec17c14484e25

    Download Submit

  • \ProgramData\kAk24512dCbIc24512\kAk24512dCbIc24512.exe
    Filesize

    423KB

    MD5

    19f3dbb5124851c4a2cead8606fcf40a

    SHA1

    8658ed712d843ab7f574a8df9de8b3f7cbdf19a2

    SHA256

    43fa64424268d736f48549f5fbdbf704f08f357c4f9f47dce772b0b8ab39e1f4

    SHA512

    aa58b784a30afa4dfa1afc493ebc868f157450f0e979fbdf959938c50473277fd8ad7e8eb015f34bafc957c566b7bb88602d7a45dba4130b14b40e4f78695a0f

    Download Submit

  • memory/2700-25-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2700-32-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2700-45-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2996-0-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2996-1-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2996-21-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/3056-14-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/3056-31-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/3056-39-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download