Overview

overview

10

Static

static

3

bd8e61a75d...18.exe

windows7-x64

10

bd8e61a75d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 23:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bd8e61a75d41c7f3b2a8b701b4341cc2_JaffaCakes118.exe

  • Size

    252KB

  • MD5

    bd8e61a75d41c7f3b2a8b701b4341cc2

  • SHA1

    e5f81b00ea48b5f510b944c2fb837234cfe56d36

  • SHA256

    b0edec3fd151af74def652d8c83a72fc75b1837ab04c73f4a49945285ed2d9b7

  • SHA512

    0e1dae8801a740f00bd5ccd75d3940f6d3641f3efbd79e91194f2743cc443c46ac044d4ab81e67fce10cc75176982a08e64027f6ed7b17deacca4e9bf6727c86

  • SSDEEP

    6144:8ml7FNnnPbuxN8b7giqR20NGNccko5Knvmb7/D26i02maSTOarRfG:fl7FNnjuxN8cGNccko5Knvmb7/D26i0Y

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd8e61a75d41c7f3b2a8b701b4341cc2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd8e61a75d41c7f3b2a8b701b4341cc2_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\povog.exe
      "C:\Users\Admin\povog.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2008

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\povog.exe
          Filesize

          252KB

          MD5

          d99f8c23825a3a6d8a399c2fed26cc3c

          SHA1

          fa08ab5e770c9b8c180f0bd937fe1d362f8b950b

          SHA256

          76481ea91c8fab68e43a6b4b13b309672cf002ced6975affb8919fb3d4751704

          SHA512

          2d5307638ee3f334ab0cf1538005dd688e943cfb703ba5b4eb9c88ba851ba3cc39ebcfead1bcc7e852914f9b50feb104407556b1a2b6cdee0056929721e945d6

          Download Submit