Overview

overview

7

Static

static

3

25a047a71b...18.exe

windows7-x64

7

25a047a71b...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 17:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    25a047a71bc68e6c19ce6d504c2e2ee3_JaffaCakes118.exe

  • Size

    418KB

  • MD5

    25a047a71bc68e6c19ce6d504c2e2ee3

  • SHA1

    87be269de34fa22abc132bf1124332272aea3a30

  • SHA256

    487dca667334fbf0a789a8751c308f089beed5729813e4fa7f5039020f8424e5

  • SHA512

    1bd13b6ab8b132a4f7cd9f254293e1eb20475c9c9be411591d5b85ed4747e888a8db28d21db686753ffd312895d2c09e845caba8e8eb028587d84fa2bb440122

  • SSDEEP

    6144:46LD5gkK9Q/mWD4fLD5jDwBS+y6H0qfLM7mM6KUZ6OM6E6ky6ua81sOgtEfVp:46fbK4kfFMBvHpf7MrlDy6uF1sO

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25a047a71bc68e6c19ce6d504c2e2ee3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\25a047a71bc68e6c19ce6d504c2e2ee3_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\ProgramData\hEo21500aAiCo21500\hEo21500aAiCo21500.exe
      "C:\ProgramData\hEo21500aAiCo21500\hEo21500aAiCo21500.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1508
    • C:\ProgramData\hEo21500aAiCo21500\hEo21500aAiCo21500.exe
      "C:\ProgramData\hEo21500aAiCo21500\hEo21500aAiCo21500.exe" "C:\Users\Admin\AppData\Local\Temp\25a047a71bc68e6c19ce6d504c2e2ee3_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4836
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3984,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
    1⤵
      PID:1052

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\hEo21500aAiCo21500\hEo21500aAiCo21500
            Filesize

            192B

            MD5

            aacf3ed9048e6fd5df8d2a2278557dba

            SHA1

            8936bf4e57e726922b746c4274fbb2c514e935e2

            SHA256

            e0495de1ee4579e9366d3cb98334fffc97bdec9138e0c38d97a57ac61f8d2a2e

            SHA512

            88a3b95984d21a17bd7cb05cd30c9259ad5366ecf59c60cb78112f303faf48068bf4746a266fffe2e23c6b7b5068daa95fd45c65018b0466714cb88a50d3dcb9

            Download Submit

          • C:\ProgramData\hEo21500aAiCo21500\hEo21500aAiCo21500
            Filesize

            192B

            MD5

            ccd1959b3eab5483af562d60f3e0f311

            SHA1

            38593a46934d81a20f3bbd1e94445086119bfc5a

            SHA256

            05a903cfea34b616d69d23454eaeaceabc0c4d1667db3a7bb3faff9e76c34618

            SHA512

            9dc28854a52112742bcfbe5253fa34fc613dcff6877fe321db2a45ed78091d4f042017e861f699617bcda256edc1bfbc79fd83da7c45b0f008596c8f4cce35b5

            Download Submit

          • C:\ProgramData\hEo21500aAiCo21500\hEo21500aAiCo21500.exe
            Filesize

            418KB

            MD5

            b5cd5bc327ba67694ac18b9cd779f981

            SHA1

            d555e758e8a6347039345510ec6d2edcb373a431

            SHA256

            3dbde762274223c4c9b94deef62e606ddc6293dd44d7d72dc3679d96debaa12b

            SHA512

            882387de7140e598e926e4643074839be4cec2ffb6aa0c219f9d56151315134b03fc3627c9a45e3e3866e6b6f183c51a4ea18cd9946620aa6effecb7c8a18176

            Download Submit

          • memory/1508-19-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/1508-23-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/2888-0-0x0000000000640000-0x0000000000641000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2888-6-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/2888-21-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/4836-28-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/4836-31-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/4836-38-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download