Overview

overview

10

Static

static

3

87a2b5e056...18.exe

windows7-x64

10

87a2b5e056...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2024, 20:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    87a2b5e056876596b49949dc0f9c6b01_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    87a2b5e056876596b49949dc0f9c6b01

  • SHA1

    4f9e78c755bafb1b0fef8d41c35c2b5844bf7d8d

  • SHA256

    9e13e38722e1dba76e9dc9bc01f0e6017672eba88785841da7588fdb9bd1163f

  • SHA512

    11b9c471d380ff1e494281194cb4f87c021d6c7a081044df966137696a738545cb21fc850c0b59e4a5c3a97341b0a6a925e7a41419ea0295dff7b79f695c4d77

  • SSDEEP

    1536:y+tkjmTQSU0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VewNeG0h/l:rkjNSU0GgAT98t

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87a2b5e056876596b49949dc0f9c6b01_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\87a2b5e056876596b49949dc0f9c6b01_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\reuok.exe
      "C:\Users\Admin\reuok.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2512

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\reuok.exe
          Filesize

          124KB

          MD5

          21113612d9708eac629803bcccdc2fe4

          SHA1

          38822bdeabd6d5ce21629f7a866874f3c6be2090

          SHA256

          1bf4a380d0e9f990ba911ff2ca302d5fd692f91a5799ad294fe95153da4d9aa0

          SHA512

          05f6f30cfad5d91830d77307b30eeb554b992044c2dec41ed2282680061aedb968b324630a7ec8b01807ec1ae0e70eb87fd2ab8baace77b267a930704d9a59f0

          Download Submit