Overview

overview

10

Static

static

3

5c8055d4c6...18.exe

windows7-x64

10

5c8055d4c6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 15:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5c8055d4c6b2ddbb08b132b5f066ee12_JaffaCakes118.exe

  • Size

    492KB

  • MD5

    5c8055d4c6b2ddbb08b132b5f066ee12

  • SHA1

    5ae8e473e94862f3a38bdbf16f8428085f309c76

  • SHA256

    a786c33385475c555805745f014bd2379f61b632fb28266664a7dcf85d3a2a88

  • SHA512

    782837d494106e53bed8f6abd08c792095b0c9cce5f0caf3522040793a7f4c95f85b4e795049efc7726273712ded02c63511f22589fa6206aaa14c1c9477192d

  • SSDEEP

    12288:CbGx+je/ygu566z3w8iiuFDnNMkP8W2aSQkGvdGebCJK83:Cb1je/+X3w8Cn+kP8W8/Jx

Score
10/10
evasionpersistencespywarestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1200
    • C:\Users\Admin\AppData\Local\Temp\5c8055d4c6b2ddbb08b132b5f066ee12_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5c8055d4c6b2ddbb08b132b5f066ee12_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Users\Admin\Lo7b43s3.exe
        C:\Users\Admin\Lo7b43s3.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Users\Admin\nvxaad.exe
          "C:\Users\Admin\nvxaad.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2476
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del Lo7b43s3.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2716
      • C:\Users\Admin\2eaa.exe
        C:\Users\Admin\2eaa.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Users\Admin\2eaa.exe
          "C:\Users\Admin\2eaa.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2604
        • C:\Users\Admin\2eaa.exe
          "C:\Users\Admin\2eaa.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2808
        • C:\Users\Admin\2eaa.exe
          "C:\Users\Admin\2eaa.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2644
      • C:\Users\Admin\3eaa.exe
        C:\Users\Admin\3eaa.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Users\Admin\AppData\Local\6ccf6dfc\X
          *0*bc*b63117cb*69.64.52.10:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1444
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:2452
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 5c8055d4c6b2ddbb08b132b5f066ee12_JaffaCakes118.exe
          3⤵
          • Deletes itself
          PID:2160
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2904

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\system32\consrv.dll
            Filesize

            29KB

            MD5

            1149c1bd71248a9d170e4568fb08df30

            SHA1

            6f77f183d65709901f476c5d6eebaed060a495f9

            SHA256

            c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

            SHA512

            9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

            Download Submit

          • \Users\Admin\2eaa.exe
            Filesize

            124KB

            MD5

            7b3def3cfe4bb0145ce8ec999978acd6

            SHA1

            c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

            SHA256

            7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

            SHA512

            8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

            Download Submit

          • \Users\Admin\3eaa.exe
            Filesize

            253KB

            MD5

            60055d4e3397db97e7cb6400b2f5cacf

            SHA1

            1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

            SHA256

            8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

            SHA512

            63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

            Download Submit

          • \Users\Admin\AppData\Local\6ccf6dfc\X
            Filesize

            38KB

            MD5

            72de2dadaf875e2fd7614e100419033c

            SHA1

            5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

            SHA256

            c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

            SHA512

            e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

            Download Submit

          • \Users\Admin\Lo7b43s3.exe
            Filesize

            232KB

            MD5

            555a30b03ba67c68c5206e84d5eef20c

            SHA1

            683fefc8ba94ab95a67d390a1d512d38b8c59170

            SHA256

            cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

            SHA512

            92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

            Download Submit

          • \Users\Admin\nvxaad.exe
            Filesize

            232KB

            MD5

            254bda8a01e36d567167ba54ad648697

            SHA1

            a15143530570aa62c6769da534e3ce14c73dfcda

            SHA256

            123e8236d8ee91663c5628c7bafd19345697bb208548f1e88d4be8f64ece27a5

            SHA512

            d64b6c4bfaa7d479dbda9c40864e4a5dd3719bb74a0ca38e7eac0830ab9bbb882811ca55f0b1378f89cf47c4862bcc1d84ac3b72dee5af0905398b1e2ef20531

            Download Submit

          • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
            Filesize

            2KB

            MD5

            11e0ec6479d63e5d99b8e99a78764852

            SHA1

            6fe917180e2dfe2b2116b5c96ad7edfe2decfe2e

            SHA256

            8638a72eef25a28486fc3aba1dbd0f8aded21e593eadac405f14657d432b6fd2

            SHA512

            faf64d015f7e7c4b0cb1ef239eef0262eef30b736ab48a20e3b384387eb6cb7797fcd88cf6ece536637dd6178365119d6f59dc6457f09dc8f47db085ad62c718

            Download Submit

          • memory/332-104-0x0000000002380000-0x000000000238B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1200-119-0x0000000002DE0000-0x0000000002DEB000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1200-120-0x0000000002DF0000-0x0000000002DFB000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1200-115-0x0000000002DE0000-0x0000000002DEB000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1200-111-0x0000000002DE0000-0x0000000002DEB000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1200-89-0x0000000002DC0000-0x0000000002DC6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/1200-93-0x0000000002DC0000-0x0000000002DC6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/1200-97-0x0000000002DC0000-0x0000000002DC6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/1280-123-0x0000000030670000-0x00000000306C7000-memory.dmp

            Filesize

            348KB

            Download

          • memory/1280-128-0x0000000030670000-0x00000000306C7000-memory.dmp

            Filesize

            348KB

            Download

          • memory/2604-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2604-45-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2604-42-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2604-40-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2604-38-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2604-53-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2604-48-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2604-47-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2644-63-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/2644-77-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/2644-73-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/2644-65-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/2644-67-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/2644-122-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/2644-71-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/2808-56-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/2808-61-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/2808-76-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/2808-121-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/2808-69-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/2808-74-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/2808-54-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/2808-58-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download