Overview

overview

10

Static

static

3

89f52470b5...18.exe

windows7-x64

10

89f52470b5...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 10:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    89f52470b51d16a86864d2ccb8331a63_JaffaCakes118.exe

  • Size

    508KB

  • MD5

    89f52470b51d16a86864d2ccb8331a63

  • SHA1

    1caabfebe90c841bb563f8694581e0d48d8e9b6c

  • SHA256

    82a5a3ed98bba98e3926ab469623112e68a9d9290ee503c6c26bb2d13222a2e9

  • SHA512

    13f5d0b051235ba5463b1d1267bbd42835da93771a9b1eea57758d83d934f21706653de95d8a9ef778cfff721003e09fa9d1f9e3edff7d463ff5b9e96ae134f7

  • SSDEEP

    6144:C3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:C3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\89f52470b51d16a86864d2ccb8331a63_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\89f52470b51d16a86864d2ccb8331a63_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\eosRo6jbz1.exe
        C:\Users\Admin\eosRo6jbz1.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Users\Admin\datef.exe
          "C:\Users\Admin\datef.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1832
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del eosRo6jbz1.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2564
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:308
      • C:\Users\Admin\2veg.exe
        C:\Users\Admin\2veg.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2988
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2756
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2792
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2704
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          PID:2408
      • C:\Users\Admin\3veg.exe
        C:\Users\Admin\3veg.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Users\Admin\AppData\Local\455ed245\X
          *0*bc*817dd686*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1936
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1996
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 89f52470b51d16a86864d2ccb8331a63_JaffaCakes118.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2720
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:700
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    1⤵
      PID:1780
    • C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      1⤵
        PID:1964
      • C:\Windows\system32\wbem\wmiprvse.exe
        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
        1⤵
          PID:272

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Windows\system32\consrv.dll
                Filesize

                29KB

                MD5

                1149c1bd71248a9d170e4568fb08df30

                SHA1

                6f77f183d65709901f476c5d6eebaed060a495f9

                SHA256

                c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

                SHA512

                9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

                Download Submit

              • \Users\Admin\2veg.exe
                Filesize

                124KB

                MD5

                116cdd8174ee4734183e8f019a548596

                SHA1

                d918d4e4bdaec0f4066c2285a5bd85903d92e23f

                SHA256

                dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

                SHA512

                377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

                Download Submit

              • \Users\Admin\3veg.exe
                Filesize

                287KB

                MD5

                357d9b4488d3191b0d6197015b326484

                SHA1

                057455015523d5b0b475dce4a49d510ba6a23ee4

                SHA256

                7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

                SHA512

                f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

                Download Submit

              • \Users\Admin\AppData\Local\455ed245\X
                Filesize

                38KB

                MD5

                72de2dadaf875e2fd7614e100419033c

                SHA1

                5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

                SHA256

                c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

                SHA512

                e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

                Download Submit

              • \Users\Admin\datef.exe
                Filesize

                180KB

                MD5

                275951e88510b9aa851aefda6a2f6f64

                SHA1

                d4523beb5741ca958b2271fafc90374f5a217d57

                SHA256

                f5578e03985104f5b7fd5285aab270316ed5e686fabd5a068a08100995638345

                SHA512

                e4ad8fd57aaad4b65ff39c98477f5456f13e8753be404f41cc476ac3f9f4539c8419db1004a57b54062f77b6e4dcfa798efcbcbadfcb09407e12cf785c75e80b

                Download Submit

              • \Users\Admin\eosRo6jbz1.exe
                Filesize

                180KB

                MD5

                582c4af3c13d489f7593c6655a9ed25f

                SHA1

                f920f89e59010c5d24507a3556cfa2b8ed406ddc

                SHA256

                560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

                SHA512

                f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

                Download Submit

              • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
                Filesize

                2KB

                MD5

                40af3963a79222555eb57f76af1a8201

                SHA1

                e6a76cf1b85a7142d3adc3f06fc640afef737118

                SHA256

                e498cf69c90534654d96aa90205429ff9668b0273c9c1c4490626086a1dc163f

                SHA512

                7a91bfb7ce9b1da411dc3abb2d289a0c77cdcaed9df0818f94e206a1660c2e114ca66e2ab9282f1060bcd4764d9cc0608905b17b98e44a15dc91d4bb3de616ac

                Download Submit

              • memory/332-114-0x0000000002290000-0x000000000229B000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1248-101-0x00000000025B0000-0x00000000025B6000-memory.dmp

                Filesize

                24KB

                Download

              • memory/1248-132-0x00000000025E0000-0x00000000025EB000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1248-131-0x00000000025D0000-0x00000000025DB000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1248-123-0x00000000025D0000-0x00000000025DB000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1248-127-0x00000000025D0000-0x00000000025DB000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1248-105-0x00000000025B0000-0x00000000025B6000-memory.dmp

                Filesize

                24KB

                Download

              • memory/1248-109-0x00000000025B0000-0x00000000025B6000-memory.dmp

                Filesize

                24KB

                Download

              • memory/2704-87-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2704-82-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2704-79-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2704-153-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2704-84-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2704-77-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2756-57-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2756-63-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2756-60-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2756-61-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2756-49-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2756-51-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2756-53-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2792-86-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2792-64-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2792-68-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2792-71-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2792-66-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2792-73-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2792-74-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2792-152-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2924-135-0x0000000030670000-0x00000000306C1000-memory.dmp

                Filesize

                324KB

                Download

              • memory/2988-42-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2988-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2988-45-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2988-40-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2988-140-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2988-38-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2988-47-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2988-48-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download