Overview

overview

10

Static

static

3

4325aafc9c...18.exe

windows7-x64

10

4325aafc9c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 20:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4325aafc9c0043551f53d763a5782921_JaffaCakes118.exe

  • Size

    416KB

  • MD5

    4325aafc9c0043551f53d763a5782921

  • SHA1

    ed1c545822143539a7bc10ccc42d0b88cd7df918

  • SHA256

    21106c5e1b96b808521d30025ead9139d8c90e383fa1460409b098b7a19e3e80

  • SHA512

    ca1c140278fde4d7b375b91da9ee474a3384e52e6cdbdcf152da4060319b91afce6ba34b73efd54d919d31fbc2614e5a38b989974f4c82d07d2a8935e140cf4b

  • SSDEEP

    12288:oDLOhQiq/baOtDO5k+XWsJQrrUmhiK2thyHRU:oDuQiqjklWhiTyHRU

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4325aafc9c0043551f53d763a5782921_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4325aafc9c0043551f53d763a5782921_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Users\Admin\ynS4WJZ6.exe
      C:\Users\Admin\ynS4WJZ6.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\zoatio.exe
        "C:\Users\Admin\zoatio.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5072
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del ynS4WJZ6.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1580
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2448
    • C:\Users\Admin\2aid.exe
      C:\Users\Admin\2aid.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2276
      • C:\Users\Admin\2aid.exe
        "C:\Users\Admin\2aid.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1000
    • C:\Users\Admin\3aid.exe
      C:\Users\Admin\3aid.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:2364
      • C:\Users\Admin\4aid.exe
        C:\Users\Admin\4aid.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:116
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 4325aafc9c0043551f53d763a5782921_JaffaCakes118.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1524

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\2aid.exe
      Filesize

      72KB

      MD5

      bfd48191f79f45416e67efe6a8f25d5d

      SHA1

      ae31da442af2fe6ef7f960c3a50a3250baeafd8e

      SHA256

      8271c7ff81aeb4d60ddf9b7c6c5c7e9a391324b999184f79bac6fcd411f804f5

      SHA512

      2b2ff2c152e6ddf98d5e1043b456f080178a61413aa37a12166759a32a7b8ae98e8adcd90c76d4601c7da1334589fe93e4691e51f90dac70d74e954d06a246b8

      Download Submit

    • C:\Users\Admin\3aid.exe
      Filesize

      208KB

      MD5

      914c8e336d83ca18bde8ec3d6dd5d852

      SHA1

      85fd8a4c0114a421d05ca78be872def090b217b8

      SHA256

      0061ffc16cd3615e7d30f22a69d65642cb13f55a357da9f379ebe904168bbe5e

      SHA512

      578e6b94bf576359daf96cc097c5798c9a1b8f3a47ba3f4f0707503ce32f78fafb6f0540a95f2ba311223e14be8f192468a4f3c644fe9cff9198e8ead92c0673

      Download Submit

    • C:\Users\Admin\4aid.exe
      Filesize

      44KB

      MD5

      27ddac23e41b3aba1371229bc3114ebe

      SHA1

      70e7b60767a38a27d22b03415006c5a265fe5e93

      SHA256

      afa5e7176ef811c85155cb18eed520d12c1bedc2c3e3e1775a197c8a687e3614

      SHA512

      e18dc372eff827a6590c3ff9a83d428ce2fef6682b9a0ddf667489f5d148472b6f9f6239c4df68eae43c377a4c1f633c45221902044288cdbfdf20708cdd1ebd

      Download Submit

    • C:\Users\Admin\ynS4WJZ6.exe
      Filesize

      292KB

      MD5

      b336ee551b4c80dde9f97aec73ea26bd

      SHA1

      fb0be70476d28d89187b369bf73a98fb040d9c0b

      SHA256

      a381f7f881ff01be2dda54067ea7e182044f130b7a69c339968262ec90180649

      SHA512

      5348846868a3f257c692dda8dfd9b7ddb0a39053de8f2b521dce7964139dbd07f5a5108a2186c491a152d932da8355b98d39babeec712175d9caeb0633784a52

      Download Submit

    • C:\Users\Admin\zoatio.exe
      Filesize

      292KB

      MD5

      a06d42ac48009469297e19aa80c634b1

      SHA1

      12fd75703559e26941ccab16902314bda607edf3

      SHA256

      29fed1d72fd5e293beab8eaf2e0dd167b1515d7ca5b65668e9070cdb78984d5f

      SHA512

      4328cc59943f7d64482d0e686b75fab259a4e6da1c105b8d03f280c34adf79b78ad47c707f6309d96c4f569a3906e595189c6be8f7bd94291042c428e467284f

      Download Submit

    • memory/1000-47-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/1000-50-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/1000-51-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/1000-52-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/4840-57-0x0000000030670000-0x00000000306A4000-memory.dmp

      Filesize

      208KB

      Download

    • memory/4840-58-0x0000000030670000-0x00000000306A4000-memory.dmp

      Filesize

      208KB

      Download