Overview

overview

10

Static

static

3

4ba53e756e...18.exe

windows7-x64

10

4ba53e756e...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    15-07-2024 22:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ba53e756edb70c888f4f3e415e90914_JaffaCakes118.exe

  • Size

    524KB

  • MD5

    4ba53e756edb70c888f4f3e415e90914

  • SHA1

    394f8fbf85f4186381a44c16a1b4200516382c7c

  • SHA256

    35eb0b22d409ea214f76107850d192d30d2c67e6509caa07cfb8ec221c95d21f

  • SHA512

    9be73a5a88f6ae4eb8cc9d744cff6918247002e55f115e62b3a91931fc42da5a5ef86cad3c746cf3e909c8832e824a87d4a3f80c0a058d2acb1ae070e5f505b3

  • SSDEEP

    12288:2SFMFpuhRp8tmnkX4C4IosE/rSkU19Zt/kMM22:RF+u+gkX3o1jSkErM2

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:336
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1188
    • C:\Users\Admin\AppData\Local\Temp\4ba53e756edb70c888f4f3e415e90914_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\4ba53e756edb70c888f4f3e415e90914_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Users\Admin\JB3O2vP3.exe
        C:\Users\Admin\JB3O2vP3.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Users\Admin\hiorot.exe
          "C:\Users\Admin\hiorot.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2364
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del JB3O2vP3.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2768
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2820
      • C:\Users\Admin\2sun.exe
        C:\Users\Admin\2sun.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2688
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2824
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2528
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:236
        • C:\Users\Admin\2sun.exe
          "C:\Users\Admin\2sun.exe"
          4⤵
          • Executes dropped EXE
          PID:2968
      • C:\Users\Admin\3sun.exe
        C:\Users\Admin\3sun.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1852
        • C:\Users\Admin\AppData\Local\fbe76925\X
          *0*bc*c9bb1da5*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3004
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:2604
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 4ba53e756edb70c888f4f3e415e90914_JaffaCakes118.exe
          3⤵
          • Deletes itself
          PID:2116
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      1⤵
        PID:2080

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\system32\consrv.dll
        Filesize

        29KB

        MD5

        1149c1bd71248a9d170e4568fb08df30

        SHA1

        6f77f183d65709901f476c5d6eebaed060a495f9

        SHA256

        c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

        SHA512

        9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

        Download Submit

      • \Users\Admin\2sun.exe
        Filesize

        128KB

        MD5

        cba16c1a489b02c4ff5720c68f35f787

        SHA1

        bd3d817f02e1492d246c067a6ddf3e0ec33d86c3

        SHA256

        0235b18287b0a3833cb877713019c2679a7699b2c848b16bfdf50244f8556e80

        SHA512

        00740a1e2bd2bba0f4f2486914fe1c885064d5dc6389561697e357a354e8cdc6707f4bd542c02179020ef69c6d9f1d3503eaf0111bb9c1eba1a64a194cb9c345

        Download Submit

      • \Users\Admin\3sun.exe
        Filesize

        278KB

        MD5

        345cbbd3a56a313f804b997f8cbecb2b

        SHA1

        9978d6f5bca8ab1486573ff073661e7cfd40c365

        SHA256

        492c8cf86fcfa07fcf5716b17593a9ec265c5aa919c2fe563a34ece1580b055c

        SHA512

        5cdb8b00ab0d653a34b3d1b2871ebeb0badfe223779dce775adf00d577a2931f77c1e6d92cda719e32a8683f6f729179f128472efdf6ec0ac18cbdbcfbbc237d

        Download Submit

      • \Users\Admin\AppData\Local\fbe76925\X
        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

        Download Submit

      • \Users\Admin\JB3O2vP3.exe
        Filesize

        228KB

        MD5

        290d691efc05b13247d2f6d8952a215b

        SHA1

        a885524eae321c2d025dd8e2fe4c8dd76dfb0ca0

        SHA256

        43b951fb64328c15a0592d228e90f05be14b4f18a902c35b5c0451020e1d82be

        SHA512

        8dfdcdd93b47db1b490a80fd1c483e5f10d18d782f34562bf7313039040c69878fb1d6ad22f1b3d6e48dcc8db507c430f11b1a976b48f9cd1769400fba4c150e

        Download Submit

      • \Users\Admin\hiorot.exe
        Filesize

        228KB

        MD5

        2acf1c0e7a28707a1a8c74d5d857ee5d

        SHA1

        4e306197b61ccfffb9c308fc658d8a641cb0425d

        SHA256

        74ccfdaf032b6ffb5c4c190b94038dfcd3bec64a18233701064d50668b953c56

        SHA512

        ee4bc7aad21916b3d2288829cde8da378f142dbc97536371ebb439e8e114fece0e1583c88855e66a0e0905a3b953583e7344886d700df52a067f7ad072c31da3

        Download Submit

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
        Filesize

        2KB

        MD5

        a6fb3c7ae7e2fdf8000eee97bb2d2411

        SHA1

        40bf52c55bc655e48a2337cf642bbac28e3cec8d

        SHA256

        10b1e83c2a5b056eff6aa1163711f7ad440c453d91d0c6f446121b257d43f647

        SHA512

        6cb494b437d561f24f9c8d84b72f8ce882f5f5418bd086c0a6dbf758d002788f4f227c7e7903e108008200be2edb6c4f6b1c508076d8d0bbb2cef21922cff868

        Download Submit

      • memory/236-152-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/236-81-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/236-73-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/236-75-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/236-78-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/236-80-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/336-114-0x0000000000C20000-0x0000000000C2B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1188-122-0x0000000002520000-0x000000000252B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1188-101-0x0000000002500000-0x0000000002506000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1188-130-0x0000000002520000-0x000000000252B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1188-126-0x0000000002520000-0x000000000252B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1188-131-0x0000000002530000-0x000000000253B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1188-104-0x0000000002500000-0x0000000002506000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1188-108-0x0000000002500000-0x0000000002506000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1472-28-0x0000000003970000-0x000000000442A000-memory.dmp

        Filesize

        10.7MB

        Download

      • memory/2528-84-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2528-66-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2528-69-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2528-64-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2528-62-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2528-83-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2528-82-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2688-46-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2688-58-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2688-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2688-41-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2688-43-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2688-135-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2688-39-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2688-57-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2824-48-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2824-59-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2824-55-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2824-60-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2824-52-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2824-50-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2824-61-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download