Overview

overview

8

Static

static

3

4db04be99e...18.exe

windows7-x64

3

4db04be99e...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2024 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4db04be99e086c9e900408032a8ff320_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    4db04be99e086c9e900408032a8ff320

  • SHA1

    c11fd112f65387ed321995e9dff4be648654d585

  • SHA256

    50bf98c9a85bfa379c856dffef58be08f611629337678e1c7ee5707558d3ba3d

  • SHA512

    20ab6f51030cc0433479c3b9db5df4f94373f80d7db0e1235dbef2e68e69f9fd984573706a2c6ea00d74cc000bcc0f401b85ea2b1c8d8a3652c9af85f07ed166

  • SSDEEP

    24576:9j8+cC/jlWT1qOhNfxBogmGqfc0Fb7qBbzEYAtqI:P7QT13XxBogIckw3E7qI

Score
8/10
discoveryevasionpersistence

Malware Config

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 33 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4db04be99e086c9e900408032a8ff320_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4db04be99e086c9e900408032a8ff320_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\tempfile2.bat
      2⤵
        PID:4576
      • C:\Program Files (x86)\Advanced Defender\advanceddefender.exe
        "C:\Program Files (x86)\Advanced Defender\advanceddefender.exe" /checkoff
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1984
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 688
          3⤵
          • Program crash
          PID:3020
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 840
        2⤵
        • Program crash
        PID:2444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1984 -ip 1984
      1⤵
        PID:1132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3604 -ip 3604
        1⤵
          PID:4040

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Advanced Defender\advanceddefender.exe
          Filesize

          1.2MB

          MD5

          4db04be99e086c9e900408032a8ff320

          SHA1

          c11fd112f65387ed321995e9dff4be648654d585

          SHA256

          50bf98c9a85bfa379c856dffef58be08f611629337678e1c7ee5707558d3ba3d

          SHA512

          20ab6f51030cc0433479c3b9db5df4f94373f80d7db0e1235dbef2e68e69f9fd984573706a2c6ea00d74cc000bcc0f401b85ea2b1c8d8a3652c9af85f07ed166

          Download Submit

        • C:\Program Files (x86)\Advanced Defender\base.wdb
          Filesize

          1KB

          MD5

          59335c59d8fcf6d32141fe2248a0e55c

          SHA1

          bf76410ad84c45d2862a73c59b84506a86d3a8aa

          SHA256

          8404905f19f09a31e7b4b6b5beb15806b331628fe7bb2a7c49b84d547d152a2a

          SHA512

          d356bc3a59b22f7079ce6193f8364c84862a064241b9693067149039d7fdfa584d9cf5ed5d746c5b7dfae0dc47a71b11d1cc3c588545ec4331c828c464b73720

          Download Submit

        • C:\Program Files (x86)\Advanced Defender\baseadd.wdb
          Filesize

          4KB

          MD5

          bed2a01a650fe3ae32f50475deeacea0

          SHA1

          3a375714d7668fd59c0ebc0ae617e92747022d38

          SHA256

          d524eca33d09d63261bba96a8ea8dc44d51a1050900877570c0d2b6db06982e1

          SHA512

          3581b56fe2097f1226377e80a93c195da0fb101e1c8a232f82563fea7f3d23bcef8e3a2a4b0e6f253dc6ef3209d04c6bf8c54c9c7e9d331ae996097271d005e2

          Download Submit

        • C:\Program Files (x86)\Advanced Defender\conf.wcf
          Filesize

          274B

          MD5

          e3682a2ac8e0fff8de885e8e437ef2d0

          SHA1

          75272358b8f4e5ffeacc871d755a76e6b9a322f4

          SHA256

          6ffdfaf3f77a28636baef2249224ebcfb7e7c724f9865e5fbfa21d14d1aa9e1d

          SHA512

          6944cdbb764ef77c5eaab2a8ce7b521502db2ab734c42ba30352a87dfc6f43c80eaffd58768a073f9afa053ca08a324e1ae2f26ba1eafec403845b70f467584d

          Download Submit

        • C:\ProgramData\Microsoft PData\track.wid
          Filesize

          5B

          MD5

          f5dffc111454b227fbcdf36178dfe6ac

          SHA1

          b27b41feecc0a5a45ad1bfa42765474174d5e09e

          SHA256

          e162e30a5a4c1e44a7e04fca063c296001f26636ecf384701ae17849a4f83b11

          SHA512

          274e9140efa22910ddd95d78419ed693c1fd63678829a26553f7047727455b3bbdf9278d2ad3ccdaf5d51413309b0c28a8b66e519c3dec027d9cc9f4370380ff

          Download Submit

        • C:\Windows\certofsystem.exe
          Filesize

          46KB

          MD5

          8738bab505367e09789e91a02337986b

          SHA1

          66e8432e8abc68480eae65a6a64bea6a1476c267

          SHA256

          d3c805fe5223d9501d95e536bb8749e8516489a0726cd88116d8d8c096595dc2

          SHA512

          29e384f3f442e9bce5c3d34e15e24323297dd51f08f5788300693220def444772d0fbff67b44fe10375ceca670baa13af59443b761fe750f84ba2580e9f2a8ab

          Download Submit

        • C:\Windows\explorers.exe
          Filesize

          32KB

          MD5

          c9a582438d3851a6572cfa75a567e7c8

          SHA1

          551904c8b909d5339a7d0f6a4f53b3431b3191c4

          SHA256

          41797d750884ddf699a1ee1c1aa6545e13a1467d10c60463532b51214d2fe871

          SHA512

          8ad278f7a6303a86a79acb8c62db6e05ec55494504ad121777ffa2a6639922122da9c58bf4f9c3d66b819269a67e656fcae3348e09e9b2b2fed0673d44d0e422

          Download Submit

        • C:\Windows\microsoftdefend.dll
          Filesize

          18KB

          MD5

          a8d2dde23081e085216413450ce9ecea

          SHA1

          7b197e51cd59bb130fdd701516ce3890fb4ab9c8

          SHA256

          ca8cccee3f4f6cba169bb565da220aac7de6655912079c04152be8f85fe7aae7

          SHA512

          c8469e1737392f6a2f252f9dd87f18c676b27d813f1934ac42548736bb958f0ac0a5a73c9e995e39e3c30485e0fd51d2048f9a1e97d984cc58f5d359d6a5723c

          Download Submit

        • C:\Windows\regp.exe
          Filesize

          37KB

          MD5

          405e6e5c06c3e0be8be6aaab679521ef

          SHA1

          e0e2073db72f5d383594f17875e9277e09deb1ea

          SHA256

          8172ad8a3c77b2faedc7bc768ee659f1c08245c654e8b38f5e206853de4926b0

          SHA512

          972e227dc7b6c3af500dc80dced1e2c75667deb04910a700ae5531d98c6f35859b86d60f55967fef8cbe6317c54d92f67a12f627b01940eb727cc02be463cdfe

          Download Submit

        • C:\Windows\secureit.com
          Filesize

          27KB

          MD5

          863ffbc9e055cc974843de1191f42309

          SHA1

          9219331e2eb3ef20d6bf1f016f46c4519ccb47bf

          SHA256

          7bda0d24bd7a6f2d867164a8a1cb55f2166e5e4bb45dd91ed2e83edc5c9a05f5

          SHA512

          113cb64ddd19ad30bd095056d8c136cef87503ebaf25bdb471e77c2dbe6f542781931ca9fc2ab07e0f41623fe3711077a3fc3794c0ba183611779dd30aeeeee5

          Download Submit

        • C:\Windows\spoos.exe
          Filesize

          49KB

          MD5

          ebb8481b89265cb919f382583fd42992

          SHA1

          f68e99afdc465a400d33b9cd173960196d3ce3df

          SHA256

          9fd1091fd169951603ec82621e248df359943b2a5f9b9f5c0983a6eb559ea065

          SHA512

          14cf5ef015a77d3c95c2154d96dea764c83732856a4825f99ef14769578eb168114365f8b4aadeaa98f450de758eefb8cfd81b0700a7ee129cbe2bf4839a2209

          Download Submit

        • C:\Windows\tempfile2.bat
          Filesize

          230B

          MD5

          6d546c66dc4a9ebbf9ee656ab14b8702

          SHA1

          69f001790fd92862a363d806e3a64c356b451c7a

          SHA256

          2a0a09deb7e35ecbfc5dd174009dbf580a150815f8d1e0e31c35a17582cea7f4

          SHA512

          7ea8427100f68a8aa239cfca50ae529bf99f499f52c4a69fbe2a1b140c2ecad0cbbcd4e4b671e154401c86c1111bd44ab67e87d126ee1c524e04a8f96f3036e5

          Download Submit

        • memory/1984-37-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-54-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-24-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-23-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-70-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-32-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-68-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-36-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-66-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-22-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-21-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-64-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-62-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-60-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-58-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-46-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-47-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-49-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-52-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-25-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1984-56-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/3604-1-0x000000000075C000-0x0000000000882000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/3604-2-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/3604-3-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/3604-4-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/3604-0-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/3604-34-0x000000000075C000-0x0000000000882000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/3604-31-0x0000000000400000-0x000000000088B000-memory.dmp

          Filesize

          4.5MB

          Download