Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/09/2024, 20:03
General
-
Target
e0ef6f0918e52efaea280dac53989603_JaffaCakes118.exe
-
Size
396KB
-
MD5
e0ef6f0918e52efaea280dac53989603
-
SHA1
133c07681b08f1e0e606cfdb075a9b7654f65ca8
-
SHA256
4a521febae3f7300e9232613f86e396cb498bba34813dada818dd076b741fceb
-
SHA512
12258e35f40c5f661688c02506879a77c603ed6370aa6c4f97a39a2a614877ca01d8a13814759520e1c1f6f5928f07debdf38c7be48cc7c5d62e8a1ce98f78f0
-
SSDEEP
12288:Nbti6v7MUMBGiKva6AcWE6C/idBoTHOSDGP+f/n:ltiEMkiyZAcWE6rdGCSDGmfP
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 11 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0ef6f0918e52efaea280dac53989603_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e0ef6f0918e52efaea280dac53989603_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240625203.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "5stur4urs45ju" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rdt66jud56u.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\rdt66jud56u.exe"C:\Users\Admin\AppData\Roaming\rdt66jud56u.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rdt66jud56u.exeC:\Users\Admin\AppData\Roaming\rdt66jud56u.exe3⤵
- Modifies WinLogon for persistence
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD565eeac27df79bacb998372ee71453edc
SHA17a755eae5b89c7ac2c79b9e67184788f84390976
SHA256dfe19a43addc0791805bb20f0fd46d6f110456a0dc1a29dc8464646980f4cfb6
SHA5128d00674a04309c0baf3e09cc25d96c0946c99537e16f99834a20602e0742e15191d3afd38f5c2b2e160f0ee0f161788f0c94f77856f2be80995a2a1398f73d51
-
Filesize
93KB
MD51173123287198dce1eb831f04e28352c
SHA139d650f4297c990a7ffaa7dc3b6d0ef903c9bd14
SHA25665d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba
SHA512e9fdb6e808b0f3ed850fb364d48609a9726fd41ad138594fc04f8d48d5672aec3aaa76af236f07c4263c053dc539f99009e74491adb03c885190dcce78f0cede
-
Filesize
396KB
MD5e0ef6f0918e52efaea280dac53989603
SHA1133c07681b08f1e0e606cfdb075a9b7654f65ca8
SHA2564a521febae3f7300e9232613f86e396cb498bba34813dada818dd076b741fceb
SHA51212258e35f40c5f661688c02506879a77c603ed6370aa6c4f97a39a2a614877ca01d8a13814759520e1c1f6f5928f07debdf38c7be48cc7c5d62e8a1ce98f78f0
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
112KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
112KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB