Overview

overview

7

Static

static

3

20fead844c...18.exe

windows7-x64

7

20fead844c...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 03:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe

  • Size

    418KB

  • MD5

    20fead844c31288d236d5dce100dfca6

  • SHA1

    525afc9c9f9f2acbf85e80f51fe5057b5f94407a

  • SHA256

    16b6315121e9fe0dc284594d3f153b5e68de432ce4655beb37a382c8531b3544

  • SHA512

    2884c94a9c4f1c1b9ae382283d5a9bef154be7753f609c41ede4ac9f47f09b7ffd01ebc4379e9dc5f4bea5cd839a415be36784cb57d619ea110ae6d32e644a79

  • SSDEEP

    6144:z1LDhBEUQ2G7E+udcoPv5n68ucAIRRNSoNbh9tjyqhDzyBkfTT9MQrFbF4mp:z1fhtQYh6VcASRNSUt9QifTT2QrP4

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe
      "C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe
      "C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe" "C:\Users\Admin\AppData\Local\Temp\20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2712

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500
          Filesize

          192B

          MD5

          499e14f205661e969f8372b8bf5e5997

          SHA1

          4a3da1b34144f3e9b7adebee7ec8c53a2bbf95f9

          SHA256

          16f8fa0bf995b91e0fa7fe992f4e485a12086a8953d4298c1c8bd6d30434192b

          SHA512

          9afa05a4dd2898cadb6e97e44416458d7938e90eebefd7419c02e7086256197f5ff6d99d185335e34df2bc67018e02b71eb65cd6b10a9cae3f4da0813061f479

          Download Submit

        • C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500
          Filesize

          192B

          MD5

          87509bd223c757571f27aa3a9b49de71

          SHA1

          596afa8d9a17cd37a02e0335793750eefc8ead8b

          SHA256

          2734768e81fd03468a33026a702637e4d30e4d5298f8c18fbab9c97975669f5b

          SHA512

          d0779bd2b00f2419d8d14715119f7fcd6f344fbbc6a74510ee9bc49a2ea205452c2e5de3c8a255b93b3dbfff874d3bcc20dd57e38e949f59932f3ce642538e82

          Download Submit

        • \ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe
          Filesize

          418KB

          MD5

          b6969fd2f343f54f45ebcf90c18d6274

          SHA1

          016a49b36c00324db8f322727450db5ab9c2cc95

          SHA256

          7d4eaefb946ad1be9ecd5b997912f7c788b899d7505df2ee96cba0c9f7338f74

          SHA512

          aea411165f79fd5323f97a50736d5d5862388c28a49e27043784ffcf95f2fbf1e25bc2f3b3f073e65f33ae31ba845bd1c014ee024d1374759fc107d938309317

          Download Submit

        • memory/2020-0-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2020-3-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

          Download

        • memory/2020-23-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

          Download

        • memory/2600-21-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

          Download

        • memory/2600-22-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

          Download

        • memory/2712-32-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

          Download

        • memory/2712-42-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

          Download