Overview

overview

10

Static

static

3

6ee1368a4b...18.exe

windows7-x64

10

6ee1368a4b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 08:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6ee1368a4b9097eb2720f307089dd4f5_JaffaCakes118.exe

  • Size

    508KB

  • MD5

    6ee1368a4b9097eb2720f307089dd4f5

  • SHA1

    00b286fa88a9fe4cb5a53693386914612468d303

  • SHA256

    78f71d8a0410d4fa5e521fda61888dc1ee2be28260c0825286c85e22145e74e7

  • SHA512

    5125127afb394c107337aa4f35f7cbb9c0b0cf09277fcd1f36a6751c0bdeaa020d6326cfe45dc9bbf7afea076836e075df3feccf18d27c6e6b1bd4fba8c7389f

  • SSDEEP

    6144:n3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:n3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\6ee1368a4b9097eb2720f307089dd4f5_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6ee1368a4b9097eb2720f307089dd4f5_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Users\Admin\eosRo6jbz1.exe
        C:\Users\Admin\eosRo6jbz1.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Users\Admin\kevun.exe
          "C:\Users\Admin\kevun.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:588
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del eosRo6jbz1.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2860
      • C:\Users\Admin\2veg.exe
        C:\Users\Admin\2veg.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2780
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2728
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1028
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1808
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          PID:1728
      • C:\Users\Admin\3veg.exe
        C:\Users\Admin\3veg.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Users\Admin\AppData\Local\2e21b6af\X
          *0*bc*ba683e0a*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1152
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1168
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 6ee1368a4b9097eb2720f307089dd4f5_JaffaCakes118.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1900
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:964
  • C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    1⤵
      PID:2648
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      1⤵
        PID:2180

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • \Users\Admin\2veg.exe
              Filesize

              124KB

              MD5

              116cdd8174ee4734183e8f019a548596

              SHA1

              d918d4e4bdaec0f4066c2285a5bd85903d92e23f

              SHA256

              dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

              SHA512

              377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

              Download Submit

            • \Users\Admin\3veg.exe
              Filesize

              287KB

              MD5

              357d9b4488d3191b0d6197015b326484

              SHA1

              057455015523d5b0b475dce4a49d510ba6a23ee4

              SHA256

              7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

              SHA512

              f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

              Download Submit

            • \Users\Admin\AppData\Local\2e21b6af\X
              Filesize

              38KB

              MD5

              72de2dadaf875e2fd7614e100419033c

              SHA1

              5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

              SHA256

              c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

              SHA512

              e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

              Download Submit

            • \Users\Admin\eosRo6jbz1.exe
              Filesize

              180KB

              MD5

              582c4af3c13d489f7593c6655a9ed25f

              SHA1

              f920f89e59010c5d24507a3556cfa2b8ed406ddc

              SHA256

              560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

              SHA512

              f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

              Download Submit

            • \Users\Admin\kevun.exe
              Filesize

              180KB

              MD5

              a3997e10669c070304e8f209f09b551a

              SHA1

              68e841a05b52dfa0851aa0a25b34e7903048c2f6

              SHA256

              932e245a0da6d0851ebbba12c1ff95d183cffdffce0fcbe1c7c97c29f8e5001f

              SHA512

              ba2f7f70dd447af5a13ecbd5ca3bc4868559afef8c2005634ebc3b3a73ebce32da9ce3fe90cad676a3e462b4e0449d93abb8cd5125215bd784532df6af5809b1

              Download Submit

            • \Windows\System32\consrv.dll
              Filesize

              29KB

              MD5

              1149c1bd71248a9d170e4568fb08df30

              SHA1

              6f77f183d65709901f476c5d6eebaed060a495f9

              SHA256

              c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

              SHA512

              9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

              Download Submit

            • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
              Filesize

              2KB

              MD5

              40af3963a79222555eb57f76af1a8201

              SHA1

              e6a76cf1b85a7142d3adc3f06fc640afef737118

              SHA256

              e498cf69c90534654d96aa90205429ff9668b0273c9c1c4490626086a1dc163f

              SHA512

              7a91bfb7ce9b1da411dc3abb2d289a0c77cdcaed9df0818f94e206a1660c2e114ca66e2ab9282f1060bcd4764d9cc0608905b17b98e44a15dc91d4bb3de616ac

              Download Submit

            • memory/332-116-0x00000000022B0000-0x00000000022BB000-memory.dmp

              Filesize

              44KB

              Download

            • memory/1028-151-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1028-74-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1028-81-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1028-64-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1028-66-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1028-68-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1028-71-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1028-73-0x0000000000400000-0x0000000000426000-memory.dmp

              Filesize

              152KB

              Download

            • memory/1208-105-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

              Filesize

              24KB

              Download

            • memory/1208-101-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

              Filesize

              24KB

              Download

            • memory/1208-123-0x0000000002E70000-0x0000000002E7B000-memory.dmp

              Filesize

              44KB

              Download

            • memory/1208-127-0x0000000002E70000-0x0000000002E7B000-memory.dmp

              Filesize

              44KB

              Download

            • memory/1208-131-0x0000000002E70000-0x0000000002E7B000-memory.dmp

              Filesize

              44KB

              Download

            • memory/1208-132-0x0000000002E80000-0x0000000002E8B000-memory.dmp

              Filesize

              44KB

              Download

            • memory/1208-109-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

              Filesize

              24KB

              Download

            • memory/1808-86-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/1808-79-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/1808-85-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/1808-89-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/1808-83-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/1808-77-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2728-62-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2728-61-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2728-54-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2728-63-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2728-56-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2728-52-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2728-59-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2780-42-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2780-47-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2780-45-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2780-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2780-38-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2780-40-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2780-137-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2780-51-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2780-48-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

              Download