Overview

overview

7

Static

static

3

b02b41f2ec...18.exe

windows7-x64

7

b02b41f2ec...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-08-2024 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    b02b41f2ec6dc0b3241a94d8302914fd

  • SHA1

    b43f92586bf26c07e4d1b9c005992d616589f864

  • SHA256

    4148e3493bfca58ee26cd770a932722453e81a42726e3916714def081b178073

  • SHA512

    a037f68cdb558d13cb40d1baafe783169862fdedeffc1f3dde6b6e8584ea6bcfcbfb33664c33aee748a128d18e00ea810a6c6fb583b5b949db47d19e489d43fb

  • SSDEEP

    6144:GZZU+iA2yWixvwPCxshRMjMvyvN7jK1z9K3azCoc35MsYduPg4YoypSr:G8F9zixvwjzMovyvNf8KmO3iPduPgXor

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 552
      2⤵
      • Program crash
      PID:1008
    • C:\ProgramData\hH28321IhDcB28321\hH28321IhDcB28321.exe
      "C:\ProgramData\hH28321IhDcB28321\hH28321IhDcB28321.exe" "C:\Users\Admin\AppData\Local\Temp\b02b41f2ec6dc0b3241a94d8302914fd_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 668
        3⤵
        • Program crash
        PID:1472
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 736 -ip 736
    1⤵
      PID:4160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4416 -ip 4416
      1⤵
        PID:4740

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\hH28321IhDcB28321\hH28321IhDcB28321
        Filesize

        192B

        MD5

        817f12b6475cef8460bce99f11d96714

        SHA1

        f53e23187dec7c400f59a70ddf66f741447de651

        SHA256

        32b9b45f0cda0c60aa6855b5922a95e9f723bfbae6a8a280ec8321ba86fbd888

        SHA512

        ec2ff8e940547bd317bc7b4f4e80ede0e8a41f002b578cb364dd5bc00f3cd3cea480acba067c8e15c5ce26d53e13366a0a65f70ec53804258a55c835bcb6f3a9

        Download Submit

      • C:\ProgramData\hH28321IhDcB28321\hH28321IhDcB28321.exe
        Filesize

        384KB

        MD5

        1c3e6253b6908820cdabc701d107cfcf

        SHA1

        be30a93d41220f50614642710c4bac47a2de0f31

        SHA256

        4ce3ca75128cd4aeaaea858c9d7023570cd49fc9f465a8df87c013c7a40f3272

        SHA512

        e22ab49d100eb958e142631e2bb5fc795b0f9dfe7446763f08128b653bf16bc1a47d896cafcb47c9c017f2e3d12373275e5ffc1d632550daa04dda2d9625625a

        Download Submit

      • memory/736-0-0x0000000002250000-0x0000000002252000-memory.dmp

        Filesize

        8KB

        Download

      • memory/736-1-0x0000000000400000-0x00000000004EE000-memory.dmp

        Filesize

        952KB

        Download

      • memory/736-14-0x0000000000400000-0x00000000004EE000-memory.dmp

        Filesize

        952KB

        Download

      • memory/4416-15-0x0000000000400000-0x00000000004EE000-memory.dmp

        Filesize

        952KB

        Download

      • memory/4416-21-0x0000000000400000-0x00000000004EE000-memory.dmp

        Filesize

        952KB

        Download

      • memory/4416-24-0x0000000000400000-0x00000000004EE000-memory.dmp

        Filesize

        952KB

        Download

      • memory/4416-31-0x0000000000400000-0x00000000004EE000-memory.dmp

        Filesize

        952KB

        Download