Overview

overview

8

Static

static

7

635db40b1e...18.exe

windows7-x64

7

635db40b1e...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 13:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    635db40b1e2754b332deb815840d8805_JaffaCakes118.exe

  • Size

    936KB

  • MD5

    635db40b1e2754b332deb815840d8805

  • SHA1

    71b200469cc78e3e76dc565d0649a4e9b42f68ec

  • SHA256

    e4266098d0bb993fa2af3f67e21659dca9af0955b71426a67211697b68f5342b

  • SHA512

    28dc94409112c8717b808f2da10184f6c00b682252346ff3b829696413aecb89103d941036e1861ef55cee71960090657522470631e9e99b828a7e65e42e4fee

  • SSDEEP

    24576:RrukSbiWEjlAHCSka4YEGubblIkhHJGyIEIGaVTe+Px7:RdKiWriSF4dvlPIOMTeMF

Score
8/10
bootkitpersistenceupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\635db40b1e2754b332deb815840d8805_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\635db40b1e2754b332deb815840d8805_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4736
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1896
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:232
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:464
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1192
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:732
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:3468
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4256
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:2732
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2996
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Modifies registry class
          PID:4024
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
        1⤵
          PID:4884
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2892
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2756

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\defender.exe
                  Filesize

                  855KB

                  MD5

                  9726356705d504e37f4975ee81bb390a

                  SHA1

                  e98a933761ea43620ad87b742b98cb535be2303f

                  SHA256

                  288943147e8c1a26ea3ce919e825b4b2034497dd1162bd2f24189b3955502e51

                  SHA512

                  6ba49918fef9dfd1e0d801d57923365b563c0e50b80e934cea2d1ce74a3b2f3c7b00342adc1aa1aa55bedd7c42b3ebc6671a701da764edada72c0cbd1faf9fe7

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                  Filesize

                  471B

                  MD5

                  fababbd9716aeb491cfe7775b3a29f51

                  SHA1

                  2e5b91bec222d7f4ab560d36077d74baf1374538

                  SHA256

                  76fe05d3d9bfb83490a5d4560f81aa69499b023bed4ca5c664fbdf7e738e6410

                  SHA512

                  de4aa104aea9abc62c69c88531018a6ab731590ca0b12852f35d9a485c27a699104b732ea8bdf80dd8a68b6a971a1047c4f80f3b16130abed20a61cef64b63ab

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                  Filesize

                  420B

                  MD5

                  686717d166019c02bc6b35aca53864f1

                  SHA1

                  2b50f7edeecdc230d60cdf90fa854ae601589384

                  SHA256

                  d5a0de93a588cfb6f1efc57863195d9ac4f818eaa947f749e5477b5b1220f730

                  SHA512

                  9b680569c6eff0532c0006aec3776b155122187a99edcdbdef284541e83217203c71c726069c4abd3652daebba098d8393f3a72658563785d2011c8b77e0555c

                  Download Submit

                • C:\Users\Admin\AppData\Local\IconCache.db
                  Filesize

                  15KB

                  MD5

                  f2fa771fd8418e4a5e32cb2c1aa464b9

                  SHA1

                  a0ba0884702871c681c144ae996fbbc23d601281

                  SHA256

                  e34db6d6f5dece090fe4056dfe83cd1abb9434365820f54879c4f1844e061b8f

                  SHA512

                  112593aca9adcab7321535403e49be3ecea56a033bdfea8428860dd5a9f39ae3b2fbfa64d01abd22d27c593c76f99c27c02221ad9ca4e02b1e62a38748fe4c4d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                  Filesize

                  1022B

                  MD5

                  27164879f802c9b880332fc88cefc814

                  SHA1

                  aeaec5a302f1bbc01df7f4f2343f6e5e87a1917f

                  SHA256

                  cef79054949267929130e9d980d09440a83acde2f1a29e7bcdfc3cf487b51ed4

                  SHA512

                  9e64084aceed9107f7f87546ed1afc71324c1ec52dd037f2babdfa0ea7694c714794e276e35acc26547c7d21d4f4c4885742f4e4c15178b9e117e1817b25b719

                  Download Submit

                • C:\Users\Public\Desktop\Malware Protection.lnk
                  Filesize

                  679B

                  MD5

                  b38c63f2b579bcaec99f28c98a05ac8f

                  SHA1

                  19982ad36c048db7dd456b93cac3c267bab61283

                  SHA256

                  2e87efa1388fbc65ccca70cc44f6be58b28f2455e46cc03b5105600397b502dd

                  SHA512

                  7541dcc76ac57e0c494f9381bab4cddf38799ae6a0e83ae0b2a0e068f1516f2cd364f24c1efc6d7c6df5b2f29d89d4078af933107f24edba4c5cd1f32207f554

                  Download Submit

                • memory/464-36-0x0000000004D10000-0x0000000004D11000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1896-31-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2996-45-0x0000000003680000-0x0000000003681000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4276-3-0x0000000000400000-0x00000000006D8000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4276-0-0x0000000000400000-0x00000000006D8000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4276-17-0x0000000000400000-0x00000000006D8000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/4276-8-0x0000000000404000-0x0000000000405000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4276-1-0x0000000000940000-0x0000000000950000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4276-2-0x0000000000940000-0x0000000000950000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4736-41-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-55-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-21-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-23-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-22-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-18-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-19-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-15-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-50-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-51-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-52-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-53-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-54-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-24-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-56-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-57-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-58-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-59-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-60-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-61-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-62-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-63-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-64-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-65-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download

                • memory/4736-66-0x0000000000400000-0x0000000000A0D000-memory.dmp

                  Filesize

                  6.1MB

                  Download