Overview

overview

7

Static

static

3

b02b41f2ec...18.exe

windows7-x64

7

b02b41f2ec...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 17:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    b02b41f2ec6dc0b3241a94d8302914fd

  • SHA1

    b43f92586bf26c07e4d1b9c005992d616589f864

  • SHA256

    4148e3493bfca58ee26cd770a932722453e81a42726e3916714def081b178073

  • SHA512

    a037f68cdb558d13cb40d1baafe783169862fdedeffc1f3dde6b6e8584ea6bcfcbfb33664c33aee748a128d18e00ea810a6c6fb583b5b949db47d19e489d43fb

  • SSDEEP

    6144:GZZU+iA2yWixvwPCxshRMjMvyvN7jK1z9K3azCoc35MsYduPg4YoypSr:G8F9zixvwjzMovyvNf8KmO3iPduPgXor

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\ProgramData\nD28321PiOaJ28321\nD28321PiOaJ28321.exe
      "C:\ProgramData\nD28321PiOaJ28321\nD28321PiOaJ28321.exe" "C:\Users\Admin\AppData\Local\Temp\b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2748

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\nD28321PiOaJ28321\nD28321PiOaJ28321
          Filesize

          192B

          MD5

          860d9f1f0809c72303f803cf2fbbaacf

          SHA1

          b94307a2039c713368135ffa9c8cae63e13bb63d

          SHA256

          71b0c4326430b949e65b26f312095af9a551ad7ae7e6b5a17638454494dbcdaf

          SHA512

          923b1fee3594819d21716d74f9ca7a336729acf5b3ca6bcbaa2fd51b4ea3523e718ad93009edfc6cebdb8bd73260f2514a815aeeb916dce4de0e055590078486

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118
          Filesize

          192B

          MD5

          291deb55e7f68c595622f8fae81ce1dc

          SHA1

          abd2def91bfc0a21c2914c644e85f78a951b2b40

          SHA256

          16db71b60ba4278f62f6d7f06f0aa93e32b62e68aaa38b836bcca7e8c6864dc7

          SHA512

          969f36b57e1d7622899d5c8dc2ac75d9bc2f1e875ec43ca1e49a7a25668e16cfbdf7b7b216e9a01da61e4bb83d57a63f24f52177489da6bdd3bc61ff06e02214

          Download Submit

        • \ProgramData\nD28321PiOaJ28321\nD28321PiOaJ28321.exe
          Filesize

          384KB

          MD5

          71a4817cbfc85c84e710db5cd5f6f431

          SHA1

          6808348f9689f594a189f11aad4355131f9c6707

          SHA256

          94749f5a13a3089ed5da0fc627aa30ce6bd969ce763cd1385229e86cdcf89e89

          SHA512

          12c0c5db05b55c4fe757887c39c784cca9f171ea25d935553a805f0c076f49138e7768874b50e1597715d590f7f3a1f537b6d57477355a26dcbc073df0c74e0a

          Download Submit

        • memory/2748-19-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/2748-25-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/2748-29-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/2748-38-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/3008-0-0x00000000002B0000-0x00000000002B2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/3008-6-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download

        • memory/3008-18-0x0000000000400000-0x00000000004EE000-memory.dmp

          Filesize

          952KB

          Download