Overview

overview

10

Static

static

7

27657163d7...18.exe

windows7-x64

10

27657163d7...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    79s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-07-2024 05:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    27657163d77487cf9806710fc06d9858_JaffaCakes118.exe

  • Size

    703KB

  • MD5

    27657163d77487cf9806710fc06d9858

  • SHA1

    7fcc30657e29a1d11c788d61659f701de725c7ab

  • SHA256

    a297c8d0dc60929e89ad7763ade6df08633aab33c739fd4733d0e9fcfba7eeac

  • SHA512

    39870df376199f69d9b206d0a823292108388e5db6eaa1553433d9e28962fa39a813a5ed8151d345a096feb902a5b4566e047db58678f1f966ebbe48a5103f73

  • SSDEEP

    12288:RXtCtx6mVaB+s/cEAgoOOeq6yfwPRs6CIqrUA+pzQmT4sc:t2kmVc+izAkOeVxsWqrUA+pzQm0

Score
10/10
aspackv2persistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27657163d77487cf9806710fc06d9858_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\27657163d77487cf9806710fc06d9858_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Windows\SysWOW64\ey360.exe
      "C:\Windows\system32\ey360.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ey360.exe
    Filesize

    63KB

    MD5

    32ad8b4c48f147bb447e8eb19a4b50b2

    SHA1

    8b0c3299c48977c07fcbb42e7b1de152aa66616e

    SHA256

    d17505414a487e31f5244a718e115d90d369b308b64385d6377032d54cba877c

    SHA512

    e04b9b35efcb3d8a3b14fce94c97d0975e47dad15fe12ec1730d434d80823c00bc1bff14c177de2fb90a0b8c7d086e68f59dc8c295dea722650d1caa0700fd13

    Download Submit

  • memory/2480-18-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/4316-19-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download