Overview

overview

8

Static

static

3

d648bf9561...18.exe

windows7-x64

8

d648bf9561...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d648bf95611f90a0a182335b3dbf5808_JaffaCakes118.exe

  • Size

    740KB

  • MD5

    d648bf95611f90a0a182335b3dbf5808

  • SHA1

    e6dfeab4c8ba31f92517b7c835bf50da337c5be3

  • SHA256

    b7bceb202f9ed86ebb0516b0f62100f74b531678f24906676c28515fe235ac15

  • SHA512

    d96817d5baf75854c99f6caa5d40f26953ba993227e98c21df4a079dea08e0e2b662fa32474b87dde75a847ca77dadba54e0a6cd7b98d93dfd14b4ef9e1082a8

  • SSDEEP

    12288:ou7sOe8PiOmd6bh0aDFD5HME8Rn9PH7hClylCyUCaJbW2iy:TMdSpFctH7hClylCyUCaHiy

Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 64 IoCs

    remove IFEO.

    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d648bf95611f90a0a182335b3dbf5808_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d648bf95611f90a0a182335b3dbf5808_JaffaCakes118.exe"
    1⤵
    • Event Triggered Execution: Image File Execution Options Injection
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Temp\22.exe
      "C:\Temp\22.exe"
      2⤵
      • Server Software Component: Terminal Services DLL
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del "C:\Temp\22.exe" > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2404
    • C:\Windows\SysWOW64\Reg.exe
      Reg Delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /F
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:4708
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "midoll.._sadll;."
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe c:\windows\system32\clean.dll, Launch
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\22.exe
    Filesize

    696KB

    MD5

    5bfaf22b3a306a6aafb4a6927b97d9dd

    SHA1

    61da887abbcf6afaadbea0f810729dd6ef58cdc7

    SHA256

    6ffee294875330a89d6df36db796046e45ed87fc93bed253b4fcac8710add5e3

    SHA512

    dfb966ff29944f681c875c901470bedcc0f65d47b02c8205c69f0eb1e3861640d751807bc06513229fb37e4cb0527b934c5620d084f3c6da0b2b3d71b5c706cc

    Download Submit

  • C:\Windows\SysWOW64\Clean.dll
    Filesize

    634KB

    MD5

    b7f913cb568249f2540b3c8cc034f8fd

    SHA1

    9481f3ac51089ed3f83f4a3c99f30868e93fb4a3

    SHA256

    089bbbe5cff872668f7f9be20ada5567b82dd53df8f1fcc16d1eddd59e9a5da8

    SHA512

    5b283d1f74937e01e7830d340366db100e2645902c29dec04b6b87a450b728d68ffc9bf941116dc2f0e32a46dccf9748ec9194d93980becc4b2218311e2438f5

    Download Submit

  • memory/552-21-0x0000000074460000-0x000000007457B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/552-24-0x0000000074460000-0x000000007457B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1928-19-0x0000000074460000-0x000000007457B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1928-23-0x0000000074460000-0x000000007457B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2348-9-0x0000000000400000-0x00000000004AF400-memory.dmp

    Filesize

    701KB

    Download

  • memory/2348-13-0x0000000074460000-0x000000007457B000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2348-22-0x0000000000400000-0x00000000004AF400-memory.dmp

    Filesize

    701KB

    Download