Overview

overview

8

Static

static

3

bf7e052ab3...18.exe

windows7-x64

8

bf7e052ab3...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-08-2024 21:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bf7e052ab31d773942b1ded15520c7f3_JaffaCakes118.exe

  • Size

    24KB

  • MD5

    bf7e052ab31d773942b1ded15520c7f3

  • SHA1

    ba2f288a9bc50f16d25421a0dcf629758ca52a25

  • SHA256

    e77160fbf8a1b25edfb2d235127162f0de19fd30af4c136d220fe674b002b544

  • SHA512

    d24cf454a5dd878249e2d04d6df6852d1399328cb48ba7b74410d5acc155b65de6599c295322a38e816ef0bbbf0065021374315ce5e8b7c5d1ff17f58449a34f

  • SSDEEP

    384:ZLIR145WA+rS/EsMmRBtKyu9kw+CBY4TmbLJNcdrnYh8TPzdfeOKmE/AhWcu:Jh9Z/v5BLTOqlNsrnuCPzFeOK1Awc

Score
8/10
discoverypersistenceupx

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf7e052ab31d773942b1ded15520c7f3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bf7e052ab31d773942b1ded15520c7f3_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\imsmn.exe
      C:\Users\Admin\AppData\Local\Temp\imsmn.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\imsmn.exe
    Filesize

    6KB

    MD5

    d03b25f1662a26d6922e6d24828cd509

    SHA1

    7d3c8e5c4ade92e6d692a63a2fc8b56089dc6193

    SHA256

    f34dc3e7292f569c454bc492c9bf3e19c3cb4650dc2397b6437367facb2e39dd

    SHA512

    69cff54d7f0f48a28a0f338d47ec6a599d83968972983a778577bedd7d830a831ad6adb29ad000c63d94d9ae625e74555bfb45c1d257aceb3d44be1814c82d8d

    Download Submit

  • memory/936-3-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/936-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download