Overview

overview

7

Static

static

3

49fab2a6e5...18.exe

windows7-x64

7

49fab2a6e5...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 13:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    49fab2a6e55c4eb396bb53bb43106053_JaffaCakes118.exe

  • Size

    398KB

  • MD5

    49fab2a6e55c4eb396bb53bb43106053

  • SHA1

    d1adb60a355daff966dbcba622472c98e03a4eee

  • SHA256

    4f56fded7683dc27f85d258c780a9fe833986519100ee9b4b13bedc13738d8e7

  • SHA512

    b64e366beaff0fab916e9891bde6c5407b983bdbae399f0125d153823a78804f78e04561cefe2f0c45b10ad8cca3c4a7b8980b09f98f63f150278c0a6bde0384

  • SSDEEP

    12288:KnB77DndX0luiksfuqdMFzC6/IFH2i7lsJ:yDnpJiklY0u2GO

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49fab2a6e55c4eb396bb53bb43106053_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49fab2a6e55c4eb396bb53bb43106053_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\ProgramData\pPcEcBj08505\pPcEcBj08505.exe
      "C:\ProgramData\pPcEcBj08505\pPcEcBj08505.exe" "C:\Users\Admin\AppData\Local\Temp\49fab2a6e55c4eb396bb53bb43106053_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4432

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\pPcEcBj08505\pPcEcBj08505.exe
          Filesize

          398KB

          MD5

          62c7f3896bcd549e70d0b83ef68ea5bc

          SHA1

          5f48463211b7c3728c5d5c269dc69fbc84c50036

          SHA256

          44c818e528def28728c65aa9df014cf891d9da9950439e16a0058cf953638f88

          SHA512

          424278edc04865d9cb6ef49369b011cd8fea23c014d398ad772543e95f92f79f9c171167b6d646832ef5602691dff6b9efe1a5fc3721388dad273e02e57f91f2

          Download Submit

        • memory/4432-15-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/4432-19-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/4432-25-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/4432-36-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/5072-1-0x0000000000400000-0x00000000004B3000-memory.dmp

          Filesize

          716KB

          Download

        • memory/5072-2-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/5072-5-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/5072-7-0x0000000000400000-0x00000000004B3000-memory.dmp

          Filesize

          716KB

          Download

        • memory/5072-18-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/5072-37-0x0000000000400000-0x00000000004B6000-memory.dmp

          Filesize

          728KB

          Download

        • memory/5072-38-0x0000000000400000-0x00000000004B3000-memory.dmp

          Filesize

          716KB

          Download