Overview

overview

10

Static

static

7

26124fa41b...18.exe

windows7-x64

10

26124fa41b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 19:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    26124fa41b097b59f2d7cfda20a07f8f_JaffaCakes118.exe

  • Size

    444KB

  • MD5

    26124fa41b097b59f2d7cfda20a07f8f

  • SHA1

    af1441fadbb8d93af53092a1afc11a44ff52af63

  • SHA256

    0ded5ed29aa0aa4e307ef74be252a21d9e40d883786ec7442c6961797e56197e

  • SHA512

    51430198441bebfdce84e78af2fb5318fbd0bc0edef223437780ac939c31888089b047576524d208ac5764f7a0a93d690c1efc9710b3986682c26447458426f1

  • SSDEEP

    6144:vkANWTS4K0F2J5DXzDh3Mr793VT+zl5ooyh6/Zs3YzoJMjXriu04ko:vErKNJ5Lp+lT+66Oq7in4ko

Score
10/10
adwarepersistenceransomwarestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 53 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Installs/modifies Browser Helper Object 2 TTPs 46 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 11 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26124fa41b097b59f2d7cfda20a07f8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\26124fa41b097b59f2d7cfda20a07f8f_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\SysWOW64\vvgeowbv.exe
      "C:\Windows\system32\vvgeowbv.exe" start
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    Filesize

    24KB

    MD5

    a51464e41d75b2aa2b00ca31ea2ce7eb

    SHA1

    5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

    SHA256

    16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

    SHA512

    b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

    Download Submit

  • \Windows\SysWOW64\vvgeowbv.exe
    Filesize

    122KB

    MD5

    1f96c349c58f5562713d6c5950260c4a

    SHA1

    6cb77fcf7f82bbe5832c5c617d09718794b685fd

    SHA256

    f3ea48099193152e5844be8d7126c0150fd12e7d8e69fdef7cd91bf7c38306f7

    SHA512

    c8944934fb6f1976094dc6a92c90bd0b086f117b421589d7ed5c7bcf94562be5508bc505f9aedc162b3ebe1392b8f2b2a00ad03f5d680a58dddcd8ea52998c3d

    Download Submit

  • memory/2912-71-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2912-73-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2912-97-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2912-162-0x0000000000400000-0x0000000000640000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/3000-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3000-60-0x0000000003410000-0x0000000003650000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/3000-68-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download