Overview

overview

7

Static

static

3

d06c11a168...18.exe

windows7-x64

7

d06c11a168...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-09-2024 20:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d06c11a1689549471d6048414d7554ed_JaffaCakes118.exe

  • Size

    910KB

  • MD5

    d06c11a1689549471d6048414d7554ed

  • SHA1

    75ab4238f17b0c5d5107492f1ba0889edfc0d42e

  • SHA256

    444f4ca4a93c3831d7cdb01083e74d4d38326d4db285f52ac1004b8b08c98930

  • SHA512

    82212de101e83ce6508ed2a1ee381c78e754efacbd5331eaef78d0e8169fc71f4182e0406980e38c30de8d8db3c79a70c3c77cae7efa84dbdff4f5c1536d65c0

  • SSDEEP

    24576:dPLok+BwHsfffffu+3W1uHPffKSi5i2JnZZ9PYvJhCswiVLZNVLCuq4slztve:d8k+BwHsfffffu+3W1uHPffKSi5i2Jnm

Score
7/10
discoveryupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d06c11a1689549471d6048414d7554ed_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d06c11a1689549471d6048414d7554ed_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Users\Admin\AppData\Local\Temp\7zSB4C9.tmp\takecontrol_client.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSB4C9.tmp\takecontrol_client.exe" 12265 aradallasdc01
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Users\Admin\AppData\Local\Temp\7zSB4C9.tmp\vncviewer.exe
        vncviewer.exe -noauto -16bit -shared -proxy 69.93.231.252::443 ID:12265
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSB4C9.tmp\takecontrol_client.exe
    Filesize

    507KB

    MD5

    021248b904e3fb2fb7a89b49a5074704

    SHA1

    16092fc68ac63eef9d56f9f7bdb2746ace2bdae6

    SHA256

    e43a0d61e10c33aa76ba4193be1ac850e7d7f60be87a8f374273cc77b40498d0

    SHA512

    f4f6351afabbdba2da9c083aef225a46d645e90e3abda8d6ce6e83225df58014fa8171af5912b2fb83b5a353b2408f05d4fa347b76d8ee2558a4283dd033e9a4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zSB4C9.tmp\vncviewer.exe
    Filesize

    732KB

    MD5

    95973838df1345ab4a28f346443f1cf3

    SHA1

    7693e6efcbd3e645afa89c8f6275516098553412

    SHA256

    57a896e7f018f872e9e682920b0627682c329ecd820fbd5695b95e695202907e

    SHA512

    99cbe01952b9e253c62fc597f0761eea2d2041a1153663a6c1a48eb33af7fa70411abaf97ba127845c043b96fadfc5f5c89a7fe2ec34758260ca605d86140606

    Download Submit

  • memory/3612-14-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3612-18-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3612-19-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3612-20-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3612-21-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

    Download