Overview

overview

10

Static

static

3

d2ff3d9ae4...18.exe

windows7-x64

10

d2ff3d9ae4...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 22:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d2ff3d9ae4bb36b2cf4b781bb8e265d7_JaffaCakes118.exe

  • Size

    358KB

  • MD5

    d2ff3d9ae4bb36b2cf4b781bb8e265d7

  • SHA1

    2e50afb67ff4f728ae19120561f5c71082d345ae

  • SHA256

    f36384a8a5101a1dab51087bbc2d5143da929a373183ff7ba1f9805f246f3f1f

  • SHA512

    1904ab6665b18dca03dc847cf6c28a699c22e196e2d18a6c55ad94c304c3947e9e73f3bb844ae6cf5bf3b3fdf894e5f6a7900f55dab57dc3c8be63756cc86179

  • SSDEEP

    6144:Pvs5mu6HUsJ+USK1reFA4HrPQrKTR6PQ9TsjYWTopg0CIFehRaQ2HbFzWGZe6:Pvs518J+nUre240rKTOQ9yYQgCjjSHxW

Score
10/10
discoverypersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2ff3d9ae4bb36b2cf4b781bb8e265d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d2ff3d9ae4bb36b2cf4b781bb8e265d7_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\ProgramData\nF21703NpNjG21703\nF21703NpNjG21703.exe
      "C:\ProgramData\nF21703NpNjG21703\nF21703NpNjG21703.exe" "C:\Users\Admin\AppData\Local\Temp\d2ff3d9ae4bb36b2cf4b781bb8e265d7_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\nF21703NpNjG21703\nF21703NpNjG21703
    Filesize

    208B

    MD5

    16fa4191d9287aa5f7c464ecb1bd32ee

    SHA1

    1bb331652dc103e9c5c15fecae9751834819a143

    SHA256

    71c0c62f4bbae3fadfa20a1f621e700288640ec704a9574d3d726e569e7e1672

    SHA512

    0ea76aae424cf77eb6d46447ee203c5fd2982186e93a4c5f6487a8b19018d1d4cbaf02fa3afe7ab1963574ae5d827fba5a9c06191ddb5625f059a3cccb741103

    Download Submit

  • \ProgramData\nF21703NpNjG21703\nF21703NpNjG21703.exe
    Filesize

    358KB

    MD5

    7543ec8c2a3fbf2bad3c3aec2a9afbf1

    SHA1

    2223cd9db193be93a3a91d37fc7456cc94e75a84

    SHA256

    d49beea04df946ee98eec4ca68d16d1696e93e64614258a13820c859bcecdb29

    SHA512

    7cdeb4ae4b2fc805689da2d158443a4168e656afc54f3af3a4b8ab3c9939c11070812f3109bec8fb112438188ac2240131e2cce0beb262b1df0f96b7df7f1e34

    Download Submit

  • memory/2280-1-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

    Download

  • memory/2280-0-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2280-10-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

    Download

  • memory/2280-32-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

    Download

  • memory/2852-33-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

    Download

  • memory/2852-40-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

    Download