Overview

overview

7

Static

static

3

bd3cb1eb94...18.exe

windows7-x64

7

bd3cb1eb94...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    134s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 21:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe

  • Size

    57KB

  • MD5

    bd3cb1eb94f951fc5c56967c8c0eea86

  • SHA1

    a9b5f3c167d78287918d247ce743b73af5a84783

  • SHA256

    64f9c7790b4037e55a35d775e2f25a94bd09f0b245d73af08dcd1f606159996a

  • SHA512

    285c5f1a1d2828dc78a3e6609fa92f57e552959df514003222324224cf6aa5f90bb45452aa6ee8419a71505b43f1546904aa945f08eae29b392bb15118e40405

  • SSDEEP

    768:ryESznCIdH45oA0PnE6KPP2kUWZZN+wK3bZWjr9nID9RDYP54kNJa6KPQBia++Rs:bSznCIK5oAuKP80NyEjxIhGP5+6q+Ds

Score
7/10
adwarediscoverystealerupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 60 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd3cb1eb94f951fc5c56967c8c0eea86_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s C:\Windows\xml2u32h.dll
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:1304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\xml2u32h.dll
    Filesize

    52KB

    MD5

    41f6cbfcb0769126f7b2f230b9dc1416

    SHA1

    0d83c777cdbbb5bb02c56f4c3ca69634a063e60c

    SHA256

    77dc6b08d30e632f5a1c04a8a2fedf4dc82810c3f9baff3f1ef4ebd08225a1ec

    SHA512

    b6a0187fb2623dda9b88be2c68d8c829af7b5df999bd94ed0d2c8897d89867d2cdb0e8457a514f5926e398fcee77d33cc37a6d5832f8bbe33d5cda57c1c28ca3

    Download Submit

  • memory/1304-3-0x0000000010000000-0x00000000104B2000-memory.dmp

    Filesize

    4.7MB

    Download