Overview

overview

8

Static

static

3

a179654add...18.exe

windows7-x64

8

a179654add...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17-08-2024 06:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a179654adde971fc4ddbcf6db29ded1e_JaffaCakes118.exe

  • Size

    50KB

  • MD5

    a179654adde971fc4ddbcf6db29ded1e

  • SHA1

    9b9122f9203d3cede00911314857efc349f95831

  • SHA256

    24ab9b3d649551d109430e86b25169d41967fb73f42a296def609853996ee5f7

  • SHA512

    3b60e530a53fcaaf863d008ae6938c4e57e37956f149739d85e85543ccc847c2b8eef31a2e0dc00f656c5998dae96a8e30f78d90b4a01531b25b2c3f8d935322

  • SSDEEP

    1536:ERX2lV62en/N5IrKRXOIgZVm0OvL78/NbNm7p+M/:ERXo6xn/NQYHo6T7mmN+E

Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 3 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a179654adde971fc4ddbcf6db29ded1e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a179654adde971fc4ddbcf6db29ded1e_JaffaCakes118.exe"
    1⤵
    • Sets service image path in registry
    • Modifies WinLogon
    • Drops file in System32 directory
    • Hide Artifacts: Hidden Users
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\SysWOW64\cacls.exe
      cacls.exe C:\Windows\system32\cmd.exe /e /t /g everyone:F
      2⤵
        PID:2764
      • C:\Windows\SondMan.exe
        C:\Windows\SondMan.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2632
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c echo ping 127.1 -n 3 >nul 2>nul >c:\2.bat&echo del "C:\Users\Admin\AppData\Local\Temp\a179654adde971fc4ddbcf6db29ded1e_JaffaCakes118.exe">>c:\2.bat&echo del c:\2.bat>>c:\2.bat&c:\2.bat
        2⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.1 -n 3
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:236

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\2.bat
      Filesize

      124B

      MD5

      3c4649136fc12aaf7744841706d80c10

      SHA1

      6bc38bebcc22e75a89e878aec10e3556fad3b53d

      SHA256

      b8fce70d3932fc2f698eb689e22b803ba2fc019165ae2be28ce9a7de3dc5a852

      SHA512

      b0345c3bf019577b515f7088e7bbaa5737442b2c73b69739d94318f4a229ba5ad1c999035fc92185d71301878aed39b34fa317d1e0f472085f7cc2e20dcea9a0

      Download Submit

    • C:\Windows\SondMan.exe
      Filesize

      144KB

      MD5

      5570cd4fea4cb68c1b9c00e473b77a8a

      SHA1

      491c6005f8d534e57d1c51fc7a66f83f4c09fb7d

      SHA256

      c9acae3f16fc4b8b7375b1f5cc3a6a3c9dcf9e8926863f8154bf797bb4634c90

      SHA512

      495fb7229925e26a5868fd39d02adc5ee25521cdd42e2c48835a13025661a331f52b776c67a8974f77aee8f7ed8302b7e9989191a68b281309ddc3e36f8fd78b

      Download Submit

    • memory/3044-0-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

      Download

    • memory/3044-2-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3044-1-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

      Download

    • memory/3044-5-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

      Download

    • memory/3044-6-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3044-23-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

      Download