Overview

overview

10

Static

static

3

abfb5b91e1...18.exe

windows7-x64

10

abfb5b91e1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 17:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    abfb5b91e191cb0d210ce1271ee435b9_JaffaCakes118.exe

  • Size

    476KB

  • MD5

    abfb5b91e191cb0d210ce1271ee435b9

  • SHA1

    fe990cbf26400817220ad23ee8ac4995d1388de5

  • SHA256

    02f51e8906ccc227e701515da3f91b600f6e56e9deec811a6ce25ebc3b7af106

  • SHA512

    5500efd0e53ba7cfc0dbcdb34409ceaeab24f05846a05bac9266887c131ce05572e9f1e7bc3262cada6fa60dc4a4b287c00b03a6b2f0fa8db413382c7e28e7fd

  • SSDEEP

    12288:ak8HAXwdAnc2i+zinpRUF2oMPze+0gKG3UPPxf:azgXwd7F+zinj2lM6+0gL

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:332
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
      PID:816
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1384
        • C:\Users\Admin\AppData\Local\Temp\abfb5b91e191cb0d210ce1271ee435b9_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\abfb5b91e191cb0d210ce1271ee435b9_JaffaCakes118.exe"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1944
          • C:\Users\Admin\ana7e3.exe
            C:\Users\Admin\ana7e3.exe
            3⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2408
            • C:\Users\Admin\hoilaa.exe
              "C:\Users\Admin\hoilaa.exe"
              4⤵
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:3056
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c tasklist&&del ana7e3.exe
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                5⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2696
          • C:\Users\Admin\axlog.exe
            C:\Users\Admin\axlog.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2372
            • C:\Users\Admin\axlog.exe
              "C:\Users\Admin\axlog.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2904
          • C:\Users\Admin\dxlog.exe
            C:\Users\Admin\dxlog.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2704
          • C:\Users\Admin\fxlog.exe
            C:\Users\Admin\fxlog.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:360
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1456
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del abfb5b91e191cb0d210ce1271ee435b9_JaffaCakes118.exe
            3⤵
            • Deletes itself
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:784
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1192

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\fxlog.exe
        Filesize

        270KB

        MD5

        790180622412379c23115e59fb7022be

        SHA1

        012b064113171c300519a4f7f10beb15c1c285b2

        SHA256

        f00f2d7ae9eb7ee10636f29acd947da0f1235574c6dcd918e5dc5358287fd613

        SHA512

        039c8da89d65d58ae021ce4532c842fcda357d5b2580b28d124c76d29a67374414dacf574bf209c044e04819d52e6c4521ed24546b4bfb06aead7a3cfc1e99d4

        Download Submit

      • \??\globalroot\systemroot\assembly\temp\@
        Filesize

        2KB

        MD5

        b5dd10a442edde3362ec99dd5c860e71

        SHA1

        2c4bec35ffcceb55c3e7e365d7821f677e093bc8

        SHA256

        73182a5f723e561ec44c23ce50a358a1da9038c3be07e049a5568134cfe62065

        SHA512

        04c57e763c5ea1e1221381a9639decbb2ba6683dd12006b22806ce91fa845598ea0d869385022c0ae45ac4e4451244b353fad4ebfd5f7e442f3dbfb98ce1a52e

        Download Submit

      • \Users\Admin\ana7e3.exe
        Filesize

        228KB

        MD5

        290efbf2f76c4ef6f2a4b21f68b29888

        SHA1

        3a6454771d5975be4bb806738dca76ca4f8faaca

        SHA256

        e61900f8b18ceb66802b0058a24677f6396df1c0ab8a4ac2281fd47929fbaf24

        SHA512

        c23a40effe75396e7a4d3eea5ffdf0807c076598fda76ea399e320731c56835bee19e3ef4413d7965c17e976cf9a06d0694f4fbfbb4917cb28b0fb3627e5b008

        Download Submit

      • \Users\Admin\axlog.exe
        Filesize

        76KB

        MD5

        925c20785e84c26666346a44251104c8

        SHA1

        2dd55917d669a1165284e1344965a7c35c5c552f

        SHA256

        7f8af46b5be6d1240777d240352f20c33e41f41f0334c02643aa7890c5d88f1a

        SHA512

        67b2a7d986793d1d18d63a5697c0a6f018211b3c01b481ff95663fd874ba14c8bc96f3695022d4637e4819ad669eb3d08e3f267c9631af2c4871982a49df958b

        Download Submit

      • \Users\Admin\dxlog.exe
        Filesize

        48KB

        MD5

        64babba1f00427096c6142b81e05c9b0

        SHA1

        9afad4f72b5bdd4ef164d02f824c7b2be5d732c6

        SHA256

        5d2419c5555890192f5b966fb24316778d1ce27728aecab0557225945ea2d6c2

        SHA512

        7abf1d9d83066d1c938a040cacb9da852ca0f7660520840b045d761d2781b7ba1263ecad9178d17026c63c26e45cafad59d3f18afc6d349fb51c06936ec785b0

        Download Submit

      • \Users\Admin\hoilaa.exe
        Filesize

        228KB

        MD5

        72b99a6b012ba8f459c9324ab5a93563

        SHA1

        d32cfdbe97c6c211e34a31ed0c1582167a4b1a2f

        SHA256

        54ab470753c165611e9876e04bd9c652a9aa6ef70b56602e5c72528c9375fe5f

        SHA512

        9893491ce60e78753abdb1786503f1cb555d4bc56d594202f6bcb01979400bcb2fe3695b417a3fc7afaebed812a0dbeae428b3e0a70e05832a1bec65063e18db

        Download Submit

      • \Windows\System32\consrv.dll
        Filesize

        53KB

        MD5

        4d7cde615a0f534bd5e359951829554b

        SHA1

        c885d00d9000f2a5dbc78f6193a052b36f4fe968

        SHA256

        414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

        SHA512

        33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

        Download Submit

      • memory/332-118-0x0000000002190000-0x00000000021A2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/332-107-0x0000000002190000-0x00000000021A2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/360-82-0x00000000029E0000-0x0000000002A1C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/360-92-0x00000000029E0000-0x0000000002A1C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/360-85-0x00000000029E0000-0x0000000002A1C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/360-88-0x00000000029E0000-0x0000000002A1C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/360-89-0x00000000029E0000-0x0000000002A1C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/360-90-0x00000000029E0000-0x0000000002A1C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/360-111-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

        Download

      • memory/360-91-0x00000000029E0000-0x0000000002A1C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/816-120-0x0000000000830000-0x000000000083B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/816-128-0x0000000000830000-0x000000000083B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/816-129-0x0000000000840000-0x000000000084B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/816-124-0x0000000000830000-0x000000000083B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1384-97-0x0000000002620000-0x0000000002626000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1384-93-0x0000000002620000-0x0000000002626000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1384-101-0x0000000002620000-0x0000000002626000-memory.dmp

        Filesize

        24KB

        Download

      • memory/2408-28-0x0000000003410000-0x0000000003ECA000-memory.dmp

        Filesize

        10.7MB

        Download

      • memory/2904-41-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-49-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-51-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-43-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-48-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-39-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-46-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2904-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download