Overview

overview

7

Static

static

7

b65a76fd42...18.exe

windows7-x64

7

b65a76fd42...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    10s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b65a76fd42efc7f36732615706b3b4f8_JaffaCakes118.exe

  • Size

    22KB

  • MD5

    b65a76fd42efc7f36732615706b3b4f8

  • SHA1

    e09918f51e18329003a99f158daeae42d37a40d7

  • SHA256

    c6c491d1e94107c1019008e9862ed1f5d860488dd3b217938383cfe27c66104c

  • SHA512

    7b74be37b4529ec2646217205402ccd11c459e4ae5e4707d527e96a2a8a6876b004100a5415c6c053059630e8f60ff4251b41020aa0a56930fba620850a9e844

  • SSDEEP

    384:9YktYUvegZT1FurcYmkSQRbGyHYF5pJJ0llqy4txdGdeUXqOkiz:qktYkDZTq4oSQRbGgYLpfSq3kAZZu

Score
7/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b65a76fd42efc7f36732615706b3b4f8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b65a76fd42efc7f36732615706b3b4f8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B65A76~1.EXE >> NUL
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2776

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\A1A6BC2E.dll
          Filesize

          215KB

          MD5

          2263fb4e09c06ddf4af1f2e6e6eea6ae

          SHA1

          3074a2bfcca0a5dcf51c50521e7ed532ac8bb107

          SHA256

          3001d283c905dd498f58f7a74a11cc4fc0331fb4de1e9fb0e6e80328abce43e4

          SHA512

          7218a02a0644f4aa673692c6f00cc066f199a375c1908cb159280f2350bc039b78eecf32b36f63627bd026e361f43b6f26ad7cd46886e698ddd63c540bc174c1

          Download Submit

        • memory/2548-0-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2548-7-0x0000000010000000-0x0000000010010000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2548-11-0x0000000010000000-0x0000000010010000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2548-10-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download