Overview

overview

8

Static

static

7

9ff66ed028...18.exe

windows7-x64

8

9ff66ed028...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2024, 21:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9ff66ed02818e66f6abf8cef4011650a_JaffaCakes118.exe

  • Size

    955KB

  • MD5

    9ff66ed02818e66f6abf8cef4011650a

  • SHA1

    ec6038bf2f296e545a59fe9fc6fcf02e99734c7a

  • SHA256

    6ac6f602171fc1d8bcf52107698d256e54f21fd76cc975aab37cfe32a2b8481a

  • SHA512

    ae3af7d99a2e23e139d5d567916294a0b81953283514a380ce23a6147a6139591445082ca16664a10baf5af2757b03f53e62cadd0d5345469049c3b08f863395

  • SSDEEP

    12288:SL3L52FHBdIwCDrA6hWVz0v/Cya+sNzaOvoJpaz/g/J/vVWyM:k5chOwCDE6hCOo+sNH8az/g/J/NWy

Score
8/10
discoveryevasionexecutionupx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ff66ed02818e66f6abf8cef4011650a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9ff66ed02818e66f6abf8cef4011650a_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" import C:\Windows\323.mp3
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4860
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" config PolicyAgent start= auto
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1456
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4576
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start PolicyAgent
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2448
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5024
    • C:\Users\Admin\AppData\Local\Temp\240638265cba.exe
      "C:\Users\Admin\AppData\Local\Temp\240638265cba.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2288
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Len0v0\One.dll
    Filesize

    10KB

    MD5

    b0e097256838fb16f979918102d13bb3

    SHA1

    1715a838b2b7e4f36424f06e16b543165d3d1792

    SHA256

    e2aa94cb988562c24f261927c1dfcd8e5139f570115abb6ef8f1cce37cc2a4e1

    SHA512

    82a7c493737e79277027132ebb6cba39a9cf7d488dad3e768fd10074eabc9454dd977a3e8a6882ddaf4b46c558d48f2a14f399a63ae8c824bf245efe1c322495

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\240638265cba.exe
    Filesize

    15KB

    MD5

    5b39a20d21c6de77213d0f709eda42d0

    SHA1

    2f357e7eba1acbace14ee0f675e8cd681e305d3e

    SHA256

    445ac8915eb17d08e5653471f4c7519a7231f595b5a24caf688ae6c9bc01865e

    SHA512

    1aed15416b7b6849bb6e4a9f7d8a83dc44a1639019af80e11d6cc869c2740912fd0a1f1ef10be8046b26766c0b22655e48ece88a14b29c1292a43f0df8a00dd9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\opeD997.tmp
    Filesize

    4.3MB

    MD5

    6c7cdd25c2cb0073306eb22aebfc663f

    SHA1

    a1eba8ab49272b9852fe6a543677e8af36271248

    SHA256

    58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705

    SHA512

    17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6

    Download Submit

  • C:\Windows\323.mp3
    Filesize

    56KB

    MD5

    bc8025bc98da7f4ed891c9f9991d3ff1

    SHA1

    70a69a7fcebe9b43f00a1fa713e3a0621bf3ac6d

    SHA256

    59b9dc39d69f8b0aa350f550e42e632b396237865776d0ce75477f8fe3f9016f

    SHA512

    7f772261e003d2df9162ae4aeaab2bda674ee2721b3300cc8b2a2f4904af6bc9c565c7f2c3e67a7394eb1a387860a2544fc5bdc3e6de384b664f8d232ad6acf5

    Download Submit

  • C:\Windows\SysWOW64\kdnfdb.dll
    Filesize

    16KB

    MD5

    add4832059173fcdb135d949194ad52b

    SHA1

    33f1dfd83e76e0897bd134d380fd56431a7cde6b

    SHA256

    2f9b075862a8509928a48c20bd988215c4f754d2ee3171cf15320ffe6f77f957

    SHA512

    ac04e7ec33592423a85dbcd0aa7a40e5e63671ad712101f007db8551be49b407c508e17d80fd3dcdece2a9d0a8cf9980aae5aa76e8452af73485fd62f31ad0d5

    Download Submit

  • memory/2728-3-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download

  • memory/2728-9-0x0000000010000000-0x0000000010005000-memory.dmp

    Filesize

    20KB

    Download

  • memory/2728-23-0x0000000002F30000-0x0000000002F36000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2728-19-0x0000000002F30000-0x0000000002F36000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2728-25-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download

  • memory/2728-0-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download

  • memory/2728-40-0x0000000002F30000-0x0000000002F36000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2728-41-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

    Download

  • memory/2728-48-0x0000000010000000-0x0000000010005000-memory.dmp

    Filesize

    20KB

    Download