Overview

overview

7

Static

static

3

b7b2a0f44e...18.exe

windows7-x64

7

b7b2a0f44e...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 12:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b7b2a0f44ebede27ccfce08544c75836_JaffaCakes118.exe

  • Size

    320KB

  • MD5

    b7b2a0f44ebede27ccfce08544c75836

  • SHA1

    7147489b11c5ae9bc1ab7364d897d539f35856b8

  • SHA256

    9983d7fb57e771a26a20ac71b33c981b96ec583f4c4521d4de87aafbfff14c78

  • SHA512

    10928f8f4b68f310d2fe810cc3e95370b3b544899de3ed6bec3441b70be2fdab95bd7f52f98bb4c34b8bc80877875755da082c398ad10b0a82737185805dfc77

  • SSDEEP

    6144:N+kht377UyZ/CcmzRmwkCLSvGlTceQUtloiGnB3jtlS3XRDeuyrNkiH6:YW37JqUwkZGEUDYZGXRDnW6

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7b2a0f44ebede27ccfce08544c75836_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b7b2a0f44ebede27ccfce08544c75836_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\ProgramData\jGo16601mDgBk16601\jGo16601mDgBk16601.exe
      "C:\ProgramData\jGo16601mDgBk16601\jGo16601mDgBk16601.exe" "C:\Users\Admin\AppData\Local\Temp\b7b2a0f44ebede27ccfce08544c75836_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\jGo16601mDgBk16601\jGo16601mDgBk16601
    Filesize

    192B

    MD5

    87973405edc24b8681902fe8fe5c6887

    SHA1

    62441bea3294fe0488ea082f79bdb8f8fbdcc414

    SHA256

    ab88a7bb9514f171cd97e6eb0f4577631b76860417ce47ef6794fd0b26ea6dfa

    SHA512

    4d9f9198053e67cc4673cd09a35c841736481a64f3ef7f8c3812b704d5dae7f2a57e3bcf2467b59ab19d9f439d5919faa60fe1e069037ea7fee1f19af1c9fe83

    Download Submit

  • C:\ProgramData\jGo16601mDgBk16601\jGo16601mDgBk16601.exe
    Filesize

    320KB

    MD5

    512e87dd8b09641ecd7c508b93891efd

    SHA1

    c9db8d0663e85983713b665325094b3d1ae53ec8

    SHA256

    6e479c616afaeb176a1a3b26eb4bd2cd75fc8e9823ad14487e4198dcadc9cbe6

    SHA512

    01e91762b36f7833b3480cf307e6790e560c7c0f53f5ad9124c3b60334684dee2c9ef6c667ab04db756cacfd62becfa89fe6690eaae98b47f7bcbe720a281545

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\b7b2a0f44ebede27ccfce08544c75836_JaffaCakes118
    Filesize

    192B

    MD5

    dd935d99c1c957173a207298c6808e6f

    SHA1

    9c129b72d25ac89687714764215fd302f8c0fb6d

    SHA256

    83a334d9f42765292ecb54ff0570f5ec386765f1e44bcae93d6f05372b367c50

    SHA512

    91a16c48c44d94395f754ea424c7c4c289b88705c8a571871eb7ec7ca0368566da8fdb8de0b3f6b0de99c234b618d99acfbd36f3f4c02c37601a18893d78bbd7

    Download Submit

  • memory/532-30-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/532-35-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/532-45-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2688-3-0x0000000000403000-0x0000000000404000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2688-2-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2688-0-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2688-10-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2688-9-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2688-32-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download