Overview

overview

7

Static

static

3

5c2352c3f6...18.exe

windows7-x64

7

5c2352c3f6...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 13:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5c2352c3f63fcae8ba25d90b7eba2010_JaffaCakes118.exe

  • Size

    396KB

  • MD5

    5c2352c3f63fcae8ba25d90b7eba2010

  • SHA1

    42d9d2b550c1c76a4b8a33203613aeef895733f7

  • SHA256

    d854eaa2f1bf6652bcd08f7e2b0254e5ff559a0736ebfcde2033b36dce457e26

  • SHA512

    ea385b78a47ac676866cd003badb85f747479da83c48764b4001d630d075bd0e3b52aa27b3f532b2893a2a32334307c757cd58d8b0d7fa70bc1de63324ca3e8f

  • SSDEEP

    6144:RsoFeojciOxK7zinhMAcRIxptrdQfnxKdprRKoZB56w9pC2mi:RsOeo427zm6As+ExKjb39pO

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c2352c3f63fcae8ba25d90b7eba2010_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c2352c3f63fcae8ba25d90b7eba2010_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 668
      2⤵
      • Program crash
      PID:4784
    • C:\ProgramData\fO01803AbOfM01803\fO01803AbOfM01803.exe
      "C:\ProgramData\fO01803AbOfM01803\fO01803AbOfM01803.exe" "C:\Users\Admin\AppData\Local\Temp\5c2352c3f63fcae8ba25d90b7eba2010_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3320
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 668
        3⤵
        • Program crash
        PID:848
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 216 -ip 216
    1⤵
      PID:640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3320 -ip 3320
      1⤵
        PID:1176

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\fO01803AbOfM01803\fO01803AbOfM01803
              Filesize

              192B

              MD5

              e9eb1b3334d53f6618020e851f84d909

              SHA1

              ec4efb4224b73140207a7eb2d94cd6462aa1a562

              SHA256

              cbaca560ae2d5d57725e06c975d13b30ce4303d0ed44a08d02d7da3067eeaceb

              SHA512

              6ce3a9c765ff2ca3314d15cc4e207b21243e7466a02909770a30b082b9612eb8108d28eaed389fb452882b1ebf3785563e510f6be6172fd77be82e754a315ccf

              Download Submit

            • C:\ProgramData\fO01803AbOfM01803\fO01803AbOfM01803.exe
              Filesize

              396KB

              MD5

              967abc228e4079c5cadb579b574a5144

              SHA1

              34abef5bdf53ee8ccddc6fddf4c45db3c315c51b

              SHA256

              9b96e37a2a0e35bbec533cc460b49b506f3543a2a3c989f0bf2834953a19e51f

              SHA512

              826edcf8307a2cd02e67be59a6745a060b26288e080831a14feb8d7288b7a3304d081d1cab413adc936007655ecd9b0a8658db63a7dfe6dcaf922dda62039585

              Download Submit

            • memory/216-0-0x0000000000630000-0x0000000000633000-memory.dmp

              Filesize

              12KB

              Download

            • memory/216-6-0x0000000000400000-0x00000000004C0000-memory.dmp

              Filesize

              768KB

              Download

            • memory/216-12-0x0000000000400000-0x00000000004C0000-memory.dmp

              Filesize

              768KB

              Download

            • memory/3320-14-0x0000000000400000-0x00000000004C0000-memory.dmp

              Filesize

              768KB

              Download

            • memory/3320-20-0x0000000000400000-0x00000000004C0000-memory.dmp

              Filesize

              768KB

              Download

            • memory/3320-23-0x0000000000400000-0x00000000004C0000-memory.dmp

              Filesize

              768KB

              Download

            • memory/3320-30-0x0000000000400000-0x00000000004C0000-memory.dmp

              Filesize

              768KB

              Download