Overview

overview

7

Static

static

7

8b1f61ea82...18.exe

windows7-x64

7

8b1f61ea82...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 16:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b1f61ea82a8bb4e3dabe4f60b0247ea_JaffaCakes118.exe

  • Size

    26KB

  • MD5

    8b1f61ea82a8bb4e3dabe4f60b0247ea

  • SHA1

    fb31835400ff4e6f56bffa8bd70c21dab91f2e61

  • SHA256

    58942a235e6fd882de94ae3981d8c8fbe1cbaed4bc2779b9cf629af16d66958d

  • SHA512

    57d27c8ea8ad8a75bfd1c7970aacff6f51ee9f1a8b82928fb1f5dc51bc2ae1d278a524257facc99f0faad6b8bf1070085a00a74dd03d936654933e6312fe42bf

  • SSDEEP

    384:9JdIssW8smeqJRfRBJjYKW6k4Isg7tKvvfuPJM46TIijtus9bbNyphaR:9Xm1JBJjXWcIs+KvvmPC46THJz2U

Score
7/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b1f61ea82a8bb4e3dabe4f60b0247ea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8b1f61ea82a8bb4e3dabe4f60b0247ea_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8B1F61~1.EXE >> NUL
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\08223B03.dll
    Filesize

    14KB

    MD5

    a3f27f0fb1a985d1163020998ee5bdeb

    SHA1

    a835a7b526d61ca7d6426e3c2618e514031bcf70

    SHA256

    b89360001391eaa1841192ba022df5e8f25e76ce522974e5ddb9c20d0be286c3

    SHA512

    b238c11208ca64ecb81cf70c688fce228e66a543469a58040f6d20b21eac3699979349dcfff25b5ffaba2c3f6ff2080b9e7645c434857d2f0938d15d018ba82f

    Download Submit

  • memory/3652-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/3652-9-0x0000000010000000-0x000000001000E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3652-10-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/3652-12-0x0000000010000000-0x000000001000E000-memory.dmp

    Filesize

    56KB

    Download