Overview

overview

7

Static

static

3

245f7f7348...18.exe

windows7-x64

7

245f7f7348...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    136s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 02:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    245f7f7348c6237beba3142c78c805b5_JaffaCakes118.exe

  • Size

    112KB

  • MD5

    245f7f7348c6237beba3142c78c805b5

  • SHA1

    327bc6a2d52601252c3bfe83f94db8cffc3044de

  • SHA256

    2587ad8e9abf25f43c4a9a3fa29de4a889f6ca725557733cc81a096a52241657

  • SHA512

    d03bc4bb197ef60e7d8980a7bb3e6857f014acc989e6e67b438f0144b60d443e1baa11e4914adc0f860b6b378cbb717dac04fd370be982dae593b291ed389d75

  • SSDEEP

    1536:WoaFkavUa8VTB7/g/nK7HF51nc1XpQI/LzKz5PQ1SR3h+gF7MaDVxp:WoaFkacplg/nKzH1mXR/LqQ1Sz+27Rjp

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\245f7f7348c6237beba3142c78c805b5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\245f7f7348c6237beba3142c78c805b5_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\svchost.bat
      C:\Users\Admin\AppData\Local\Temp\svchost.bat
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.bat
    Filesize

    112KB

    MD5

    245f7f7348c6237beba3142c78c805b5

    SHA1

    327bc6a2d52601252c3bfe83f94db8cffc3044de

    SHA256

    2587ad8e9abf25f43c4a9a3fa29de4a889f6ca725557733cc81a096a52241657

    SHA512

    d03bc4bb197ef60e7d8980a7bb3e6857f014acc989e6e67b438f0144b60d443e1baa11e4914adc0f860b6b378cbb717dac04fd370be982dae593b291ed389d75

    Download Submit

  • memory/2064-31-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2064-30-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2064-29-0x000000001E5B0000-0x000000001E5C9000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2064-27-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2064-24-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2064-20-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2064-21-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2064-19-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/4572-11-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/4572-0-0x00007FFA5B815000-0x00007FFA5B816000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4572-9-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/4572-8-0x000000001CDC0000-0x000000001CE20000-memory.dmp

    Filesize

    384KB

    Download

  • memory/4572-7-0x000000001BE80000-0x000000001BECC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4572-6-0x000000001B200000-0x000000001B208000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4572-23-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/4572-5-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/4572-4-0x000000001BD20000-0x000000001BDBC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4572-3-0x000000001B710000-0x000000001BBDE000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/4572-2-0x00007FFA5B560000-0x00007FFA5BF01000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/4572-1-0x000000001B140000-0x000000001B1E6000-memory.dmp

    Filesize

    664KB

    Download