Overview

overview

8

Static

static

7

a5b0a5df15...18.exe

windows7-x64

8

a5b0a5df15...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    135s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-08-2024 06:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5b0a5df15e34508fa167dd8e4c76521_JaffaCakes118.exe

  • Size

    130KB

  • MD5

    a5b0a5df15e34508fa167dd8e4c76521

  • SHA1

    50b5ff90adeb2b12eed855d75f4e015d060529f5

  • SHA256

    ce9d392d3f597e61986cb04eb3c65a9bac221d4ecfdb25813b140703642f212e

  • SHA512

    a4743307ec109428acfb065debe770a4e9926e4c57631beace531e5e2dfa0e9210efc6a3e53b575f0786fca7cffc599afbb8e5a97fbddef3a5a03bd9f2d909f8

  • SSDEEP

    3072:uXdbMksRkZdWpB1NoCzkn0zKFhMfYjecvYBe9X5y:2MkSkGr1NoQk0RfYfvqi

Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
    • C:\Users\Admin\AppData\Local\Temp\a5b0a5df15e34508fa167dd8e4c76521_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a5b0a5df15e34508fa167dd8e4c76521_JaffaCakes118.exe"
      1⤵
      • Checks computer location settings
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3680
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\bhoplugin.dll
        2⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5048
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A5B0A5~1.EXE > nul
        2⤵
        • System Location Discovery: System Language Discovery
        PID:64

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\bhoplugin.dll
      Filesize

      28KB

      MD5

      a98d7c1030affd4214ec1664b4f0f332

      SHA1

      7b5162c2aed6540cdca0833519609ad97523729d

      SHA256

      44b7dfcaad69dfb34df8dd671768d4c24701da2307f4a23d6edd861454d12f20

      SHA512

      c404ddb9cd98f9ce17c797200c75c2a1e393ea1feeae1a31171008f06cbeff79c5175ee1686521a2f7b885cabeb9e275f509c59241bc5ea6629264193413a6fc

      Download Submit

    • memory/3680-0-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

      Download

    • memory/3680-5-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

      Download

    • memory/5048-8-0x0000000010000000-0x0000000010015000-memory.dmp

      Filesize

      84KB

      Download