Overview

overview

7

Static

static

3

5a6c6fa4a5...18.exe

windows7-x64

7

5a6c6fa4a5...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 04:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5a6c6fa4a50df2e5f1edfd5947682141_JaffaCakes118.exe

  • Size

    2.3MB

  • MD5

    5a6c6fa4a50df2e5f1edfd5947682141

  • SHA1

    a9ee8f34cd4503a321336ebc18e65210a0b1381f

  • SHA256

    e645cb2cea5bfd3b1522b1dc7e421bcd16a57aa6eeabe25afafed1e2f8c0f0f3

  • SHA512

    50ad7f8dd0940c41cc157154465bfee43292fa180d9909e7d2d3f2fa5977cc213da335edfa9ce892cc23a6c192bff847dde07f28b4a784d474419294258183ec

  • SSDEEP

    49152:9VMlpJ+58vZQCeJOIiEP9qUQxcTz0DjoSKnTd:9mlpJ+5+eJOy8UScKKT

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a6c6fa4a50df2e5f1edfd5947682141_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5a6c6fa4a50df2e5f1edfd5947682141_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Local\Temp\Gasi.exe
      C:\Users\Admin\AppData\Local\Temp\Gasi.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetWindowsHookEx
      PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Gasi.exe
    Filesize

    1.8MB

    MD5

    e926f10095b0c5433a2ad70672b47402

    SHA1

    f6cc10477c081aee86446c73ca38aec9196c718b

    SHA256

    132e75b0c1ac82433bbe262a3e3694508f6ca9e64d94aeb5f726fc1da901e08f

    SHA512

    1062947b071de497e48c935c2a6bbacdf9d97497933c06f5a765920eb7cda1034bf0815857e2cfe2f75969d5cb73460453689a34f773f7689645490a06f303ec

    Download Submit

  • memory/3940-5-0x0000000000400000-0x00000000007FC000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/3940-7-0x0000000000400000-0x00000000007FC000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/3940-19-0x0000000000400000-0x00000000007FC000-memory.dmp

    Filesize

    4.0MB

    Download