Overview

overview

7

Static

static

3

5ed88caffa...18.exe

windows7-x64

7

5ed88caffa...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 03:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5ed88caffaacf53a48864d495f33361a_JaffaCakes118.exe

  • Size

    440KB

  • MD5

    5ed88caffaacf53a48864d495f33361a

  • SHA1

    4829737ca8204a13babeee1f4e12ef791f44902e

  • SHA256

    395ea75adc8e3bf6c64e208a53303e185beb254c6809d3ad32d9e1804e12af5d

  • SHA512

    053ede17139e00be3df44548e76f565e6977daf0f8c74852681a04b7c18bc997f3e5cae83c716302f7a9e1fc550668a866ef9c089cfc5c8e98c72fd6acb8e9e1

  • SSDEEP

    6144:A8SqmttVULycOdWd4iydGc6DZawlIRZnhd2VRRn0xn57TvDktqx4zFMWzQ:ApFts+/Wd4lg5eZnhcWx5TnMPzQ

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ed88caffaacf53a48864d495f33361a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5ed88caffaacf53a48864d495f33361a_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\ProgramData\aI06509DjImA06509\aI06509DjImA06509.exe
      "C:\ProgramData\aI06509DjImA06509\aI06509DjImA06509.exe" "C:\Users\Admin\AppData\Local\Temp\5ed88caffaacf53a48864d495f33361a_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1452

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\aI06509DjImA06509\aI06509DjImA06509.exe
          Filesize

          440KB

          MD5

          9502f871402b78cdf85a36974c95afbd

          SHA1

          3f5e3968e2ddd68eed0b991af13593995472b2c7

          SHA256

          b3ccfcb5d6f04b9720fedc65cae1b939049e537d2323ef13ab1f03ccb0db7432

          SHA512

          e3a7f64b8744beca4776aaf5d31e4abd17d37d9890482ec1e75b94c7cb2ec9c04a7e0d5c22a0e4eb643a8d790d7ee835ddf8614d8341ef04d8b2bec7cd2dc8bb

          Download Submit

        • memory/1352-1-0x0000000000400000-0x00000000004BF000-memory.dmp

          Filesize

          764KB

          Download

        • memory/1352-2-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

          Download

        • memory/1352-14-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

          Download

        • memory/1352-15-0x0000000000400000-0x00000000004BF000-memory.dmp

          Filesize

          764KB

          Download

        • memory/1452-17-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

          Download

        • memory/1452-25-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

          Download

        • memory/1452-32-0x0000000000400000-0x00000000004C2000-memory.dmp

          Filesize

          776KB

          Download