Overview

overview

8

Static

static

3

d648bf9561...18.exe

windows7-x64

8

d648bf9561...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    137s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d648bf95611f90a0a182335b3dbf5808_JaffaCakes118.exe

  • Size

    740KB

  • MD5

    d648bf95611f90a0a182335b3dbf5808

  • SHA1

    e6dfeab4c8ba31f92517b7c835bf50da337c5be3

  • SHA256

    b7bceb202f9ed86ebb0516b0f62100f74b531678f24906676c28515fe235ac15

  • SHA512

    d96817d5baf75854c99f6caa5d40f26953ba993227e98c21df4a079dea08e0e2b662fa32474b87dde75a847ca77dadba54e0a6cd7b98d93dfd14b4ef9e1082a8

  • SSDEEP

    12288:ou7sOe8PiOmd6bh0aDFD5HME8Rn9PH7hClylCyUCaJbW2iy:TMdSpFctH7hClylCyUCaHiy

Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 64 IoCs

    remove IFEO.

    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d648bf95611f90a0a182335b3dbf5808_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d648bf95611f90a0a182335b3dbf5808_JaffaCakes118.exe"
    1⤵
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:292
    • C:\Temp\22.exe
      "C:\Temp\22.exe"
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del "C:\Temp\22.exe" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2816
    • C:\Windows\SysWOW64\Reg.exe
      Reg Delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /F
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:2256
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "midoll.._sadll;."
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe c:\windows\system32\clean.dll, Launch
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\22.exe
    Filesize

    696KB

    MD5

    5bfaf22b3a306a6aafb4a6927b97d9dd

    SHA1

    61da887abbcf6afaadbea0f810729dd6ef58cdc7

    SHA256

    6ffee294875330a89d6df36db796046e45ed87fc93bed253b4fcac8710add5e3

    SHA512

    dfb966ff29944f681c875c901470bedcc0f65d47b02c8205c69f0eb1e3861640d751807bc06513229fb37e4cb0527b934c5620d084f3c6da0b2b3d71b5c706cc

    Download Submit

  • \Windows\SysWOW64\Clean.dll
    Filesize

    634KB

    MD5

    b7f913cb568249f2540b3c8cc034f8fd

    SHA1

    9481f3ac51089ed3f83f4a3c99f30868e93fb4a3

    SHA256

    089bbbe5cff872668f7f9be20ada5567b82dd53df8f1fcc16d1eddd59e9a5da8

    SHA512

    5b283d1f74937e01e7830d340366db100e2645902c29dec04b6b87a450b728d68ffc9bf941116dc2f0e32a46dccf9748ec9194d93980becc4b2218311e2438f5

    Download Submit

  • memory/292-12-0x0000000003250000-0x0000000003300000-memory.dmp

    Filesize

    704KB

    Download

  • memory/292-11-0x0000000003250000-0x0000000003300000-memory.dmp

    Filesize

    704KB

    Download

  • memory/1928-28-0x0000000074770000-0x000000007488B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1928-27-0x0000000074770000-0x000000007488B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1928-31-0x0000000074770000-0x000000007488B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2800-22-0x0000000074770000-0x000000007488B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2800-30-0x0000000074770000-0x000000007488B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3056-14-0x0000000000400000-0x00000000004AF400-memory.dmp

    Filesize

    701KB

    Download

  • memory/3056-18-0x0000000074770000-0x000000007488B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3056-29-0x0000000000400000-0x00000000004AF400-memory.dmp

    Filesize

    701KB

    Download