Overview

overview

10

Static

static

3

eac7e6e96b...18.exe

windows7-x64

10

eac7e6e96b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 06:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe

  • Size

    508KB

  • MD5

    eac7e6e96b3fd2185b7bbddb0d2d7d7b

  • SHA1

    9fb0d51ad50ac95f7cda83a965b03ae08ad41e5a

  • SHA256

    742ee21fa9cb5273263c22d7cf21811236f884eb3f5950ad48dd54273eb6a2ac

  • SHA512

    f8a2ac86a0ce851acab1c9ec78c5133928f838fbec565a439f42c78e9bad976792a29de8d4f93ca2661ebf81cf15e9032d14a40cc8a75dda99a7ab04e1e8ff6b

  • SSDEEP

    6144:O3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:O3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:336
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Users\Admin\eosRo6jbz1.exe
        C:\Users\Admin\eosRo6jbz1.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2952
        • C:\Users\Admin\muoex.exe
          "C:\Users\Admin\muoex.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1948
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del eosRo6jbz1.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3044
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2752
      • C:\Users\Admin\2veg.exe
        C:\Users\Admin\2veg.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2728
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2556
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1032
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:304
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          PID:1708
      • C:\Users\Admin\3veg.exe
        C:\Users\Admin\3veg.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Users\Admin\AppData\Local\d7401610\X
          *0*bc*e5065e5a*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1960
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:928
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1428
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    1⤵
      PID:2408
    • C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      1⤵
        PID:3000

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\muoex.exe
        Filesize

        180KB

        MD5

        9ae83a6f168404d3b1f09f9fe6b791a7

        SHA1

        3630370795cee3483b004863d6536f52e350e724

        SHA256

        93ccd81eee4a064ffdca26017499e242c0c588c7e67229d225a6f08a96064a41

        SHA512

        7938297f91c564b3821a0f1bae8ff59f0fc1eb7315eb7a0372c1e75f9357d6bd3ea44377a48e9c6f46401efeea21689e0371a864087b8cd259a935e3c0bc4e36

        Download Submit

      • C:\Windows\system32\consrv.dll
        Filesize

        29KB

        MD5

        1149c1bd71248a9d170e4568fb08df30

        SHA1

        6f77f183d65709901f476c5d6eebaed060a495f9

        SHA256

        c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

        SHA512

        9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

        Download Submit

      • \Users\Admin\2veg.exe
        Filesize

        124KB

        MD5

        116cdd8174ee4734183e8f019a548596

        SHA1

        d918d4e4bdaec0f4066c2285a5bd85903d92e23f

        SHA256

        dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

        SHA512

        377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

        Download Submit

      • \Users\Admin\3veg.exe
        Filesize

        287KB

        MD5

        357d9b4488d3191b0d6197015b326484

        SHA1

        057455015523d5b0b475dce4a49d510ba6a23ee4

        SHA256

        7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

        SHA512

        f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

        Download Submit

      • \Users\Admin\AppData\Local\d7401610\X
        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

        Download Submit

      • \Users\Admin\eosRo6jbz1.exe
        Filesize

        180KB

        MD5

        582c4af3c13d489f7593c6655a9ed25f

        SHA1

        f920f89e59010c5d24507a3556cfa2b8ed406ddc

        SHA256

        560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

        SHA512

        f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

        Download Submit

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
        Filesize

        2KB

        MD5

        40af3963a79222555eb57f76af1a8201

        SHA1

        e6a76cf1b85a7142d3adc3f06fc640afef737118

        SHA256

        e498cf69c90534654d96aa90205429ff9668b0273c9c1c4490626086a1dc163f

        SHA512

        7a91bfb7ce9b1da411dc3abb2d289a0c77cdcaed9df0818f94e206a1660c2e114ca66e2ab9282f1060bcd4764d9cc0608905b17b98e44a15dc91d4bb3de616ac

        Download Submit

      • memory/304-141-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/304-86-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/304-87-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/304-89-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/304-77-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/304-75-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/336-117-0x0000000000EC0000-0x0000000000ECB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1032-72-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1032-69-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1032-67-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1032-83-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1032-85-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1032-84-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1032-65-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1032-140-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1208-102-0x00000000025E0000-0x00000000025E6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1208-110-0x00000000025E0000-0x00000000025E6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1208-124-0x0000000002600000-0x000000000260B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1208-106-0x00000000025E0000-0x00000000025E6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1208-128-0x0000000002600000-0x000000000260B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1208-133-0x0000000002610000-0x000000000261B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1208-132-0x0000000002600000-0x000000000260B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2556-64-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2556-59-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2556-62-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2556-55-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2556-61-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2556-51-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2556-53-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2728-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2728-48-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2728-47-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2728-45-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2728-42-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2728-138-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2728-57-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2728-40-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2728-38-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download