Overview

overview

8

Static

static

7

29181f32ef...18.exe

windows7-x64

8

29181f32ef...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    06-07-2024 17:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29181f32ef2f78cc485b0d037bc99878_JaffaCakes118.exe

  • Size

    27KB

  • MD5

    29181f32ef2f78cc485b0d037bc99878

  • SHA1

    5505ec68093ee024de753457f1eaa971ae714c89

  • SHA256

    e7a7fa6d383f2081b2fe7de88ecfb86dfac1f524f26454d699b109d1482f3b9b

  • SHA512

    0faddcf760dafef2e19412bc498c7004090e8385b269d1ac6045a0543b323c830b8adc119ba4dd26c6ea913a06968db153570252b9a886a84cc85a85e26c687e

  • SSDEEP

    768:tmC5luW1li8Pd4dkGy/javV4sAZ0om0sjtn4Lgq:Tq862+vqG10sjtn4Eq

Score
8/10
persistenceupx

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29181f32ef2f78cc485b0d037bc99878_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\29181f32ef2f78cc485b0d037bc99878_JaffaCakes118.exe"
    1⤵
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im ekrn.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3052
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im egui.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1532
    • C:\Users\Admin\AppData\Local\Temp\~f798e31.tmp
      C:\Users\Admin\AppData\Local\Temp\~f798e31.tmp
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~f798e31.tmp
    Filesize

    6KB

    MD5

    8271769d2e72a78ee16a407bc1fa3a1a

    SHA1

    85d1c83e794c251f736d25f511f949b449f5f2d8

    SHA256

    2fca011a75bb49f5a70478f7aaf1ccf4615554c7df1607f9ec735666d3a87070

    SHA512

    144d3fe43f382ab2bcb413055179eaaa557fca065f624fe172fa709ecbd95b41079f4c3f14b7b0535cef4bf7bf5702d756bdf14f92996b1ba187f8c69eb299a9

    Download Submit

  • memory/2244-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2244-5-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2244-19-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download