Overview

overview

8

Static

static

7

94598b5a39...18.exe

windows7-x64

8

94598b5a39...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 19:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    94598b5a39e232953b18d42140a8a472_JaffaCakes118.exe

  • Size

    11KB

  • MD5

    94598b5a39e232953b18d42140a8a472

  • SHA1

    1688ea534785c0af33a8b146648252b55b27c086

  • SHA256

    c95457aef0472086be4d411da2a02b852064b389a3a147ec5f133df8b75260da

  • SHA512

    01e551f1c2f29e5a34944fef8ed7c3626d5c9d4dba5194303a73895795d67382def5d8954433941b856321282191db0a74ab94383fdbc860b3040b9dd0912372

  • SSDEEP

    192:/TtXiYy7pLEprKRozOhFWBg1dfsbWXTB0DeQtWAQg:/TtXifAmRozoDsbWLaWAQg

Score
8/10
discoverypersistenceupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 60 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94598b5a39e232953b18d42140a8a472_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\94598b5a39e232953b18d42140a8a472_JaffaCakes118.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://helminger-hof.at/mcratV1/index.html
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4876 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1000
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://helminger-hof.at/m3/MS_3.html
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3916 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1064

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D107217C-59A6-11EF-9A03-DA2E3A28CA1B}.dat
          Filesize

          5KB

          MD5

          a3b6534ba2fe5b12000cc591e1112088

          SHA1

          01f378a4618c25e22df350727228b24cc5559eac

          SHA256

          726a01f8b0cc8c70bd88089b18771825bf082ee11545e60bece408d0ccdc1006

          SHA512

          14e85386ea48312653532f4fc8b8b5a4f6d5f80e186bd32988a61ca8035ca1e62d963ad819dddb5f7db43c57d22e801fa07cd929a21445863176e5e5c560a163

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1D47.tmp
          Filesize

          15KB

          MD5

          1a545d0052b581fbb2ab4c52133846bc

          SHA1

          62f3266a9b9925cd6d98658b92adec673cbe3dd3

          SHA256

          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

          SHA512

          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~DF5D606BE0B4745CC1.TMP
          Filesize

          16KB

          MD5

          9ffcf967410609eab508f254e7ca6aa2

          SHA1

          061671a355104728137c16cdec077b7312545f36

          SHA256

          a3ec8754d1131e7e3f9e35a5ea52257b5cae7686f3f4355da048ac16f4a30e98

          SHA512

          11d215e25afe2eb70c54c54c6b4e3125382c842324889ffc15e1b9f0e333c04473e9a8eed6fbda0c09478693811ef46efe97a16d08209ef00496b98afd6b6973

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
          Filesize

          3KB

          MD5

          4067364fd5ce8fbb39d6e9952a17e041

          SHA1

          05f9c06bff74a5cfbec0983b7e2cc14ebc6673a8

          SHA256

          c1ef1f925ec005e48cdc9430ff7096d5907b4f681595bde7cfdf782f44e1539f

          SHA512

          8fa55f8c76dd7f88344c32e65438d2e8000496a76e03a6050c45fb6f00eb18e4ec4022836dd45c484965edd1fdee683e4974fb5a96fdf2dce2b912c61b31c36a

          Download Submit

        • memory/2336-0-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2336-6-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

          Download