Overview

overview

8

Static

static

3

2d38995dbd...18.exe

windows7-x64

1

2d38995dbd...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240708-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 17:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2d38995dbde76b4e2a4649d240e712d3_JaffaCakes118.exe

  • Size

    22KB

  • MD5

    2d38995dbde76b4e2a4649d240e712d3

  • SHA1

    ca4e19101fdd3fdfac8b1f137cf4d0f47087d6e2

  • SHA256

    33c405b07741d2c8769ba2b39da1e88ee54523f815edeb42831e25d5f79878d9

  • SHA512

    9e0e5252832df68ae149bc3f42f02639db0b652c73369d93c94473a6be181342ce30cd75495ab7b3833a764fef2237028f300f733f27563b12bb154627c53ab6

  • SSDEEP

    384:lqrzpcFaKMqDhXU/d8RykgACflU7pkFriD9b/vISEzbHrK555MRcrKLMCW4N:c2MhqDid8RyeCfifhoxHrK5558+KocN

Score
8/10
persistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d38995dbde76b4e2a4649d240e712d3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2d38995dbde76b4e2a4649d240e712d3_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 C:\Windows\system32\icqzlt29.dll Start
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3136

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\icqzlt29.dll
          Filesize

          14KB

          MD5

          bbea68a8d957dd4ba4e511428ceb7a63

          SHA1

          5ab9e13b39bffaf92e485343e3ad838935df8b9a

          SHA256

          c620c7c23ace5b8bb3b5d5bf2f92584321853fb4cd2ca1bee51e3785c338a889

          SHA512

          b4184412f48997f56f8639e5c59aaa5ca528b28b610ec662e42b0c1a12052f0dd156bc1239bd03c00310de3e756c0fc46702a9e0daa507173445b25c9ae8f463

          Download Submit

        • memory/2264-16-0x0000000000400000-0x00000000004059D0-memory.dmp

          Filesize

          22KB

          Download