Overview

overview

10

Static

static

3

eac7e6e96b...18.exe

windows7-x64

10

eac7e6e96b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 06:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe

  • Size

    508KB

  • MD5

    eac7e6e96b3fd2185b7bbddb0d2d7d7b

  • SHA1

    9fb0d51ad50ac95f7cda83a965b03ae08ad41e5a

  • SHA256

    742ee21fa9cb5273263c22d7cf21811236f884eb3f5950ad48dd54273eb6a2ac

  • SHA512

    f8a2ac86a0ce851acab1c9ec78c5133928f838fbec565a439f42c78e9bad976792a29de8d4f93ca2661ebf81cf15e9032d14a40cc8a75dda99a7ab04e1e8ff6b

  • SSDEEP

    6144:O3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:O3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Users\Admin\eosRo6jbz1.exe
      C:\Users\Admin\eosRo6jbz1.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:656
      • C:\Users\Admin\tooibu.exe
        "C:\Users\Admin\tooibu.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:876
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del eosRo6jbz1.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3116
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3976
    • C:\Users\Admin\2veg.exe
      C:\Users\Admin\2veg.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2012
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1356
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1052
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:940
      • C:\Users\Admin\2veg.exe
        "C:\Users\Admin\2veg.exe"
        3⤵
        • Executes dropped EXE
        PID:5072
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 80
          4⤵
          • Program crash
          PID:2392
    • C:\Users\Admin\3veg.exe
      C:\Users\Admin\3veg.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Users\Admin\AppData\Local\2a57e064\X
        *0*bc*4bd37208*31.193.3.240:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:436
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Modifies registry class
          PID:4236
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del eac7e6e96b3fd2185b7bbddb0d2d7d7b_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5072 -ip 5072
    1⤵
      PID:1112

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\2veg.exe
      Filesize

      124KB

      MD5

      116cdd8174ee4734183e8f019a548596

      SHA1

      d918d4e4bdaec0f4066c2285a5bd85903d92e23f

      SHA256

      dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

      SHA512

      377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

      Download Submit

    • C:\Users\Admin\3veg.exe
      Filesize

      287KB

      MD5

      357d9b4488d3191b0d6197015b326484

      SHA1

      057455015523d5b0b475dce4a49d510ba6a23ee4

      SHA256

      7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

      SHA512

      f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

      Download Submit

    • C:\Users\Admin\AppData\Local\2a57e064\X
      Filesize

      38KB

      MD5

      72de2dadaf875e2fd7614e100419033c

      SHA1

      5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

      SHA256

      c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

      SHA512

      e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

      Download Submit

    • C:\Users\Admin\eosRo6jbz1.exe
      Filesize

      180KB

      MD5

      582c4af3c13d489f7593c6655a9ed25f

      SHA1

      f920f89e59010c5d24507a3556cfa2b8ed406ddc

      SHA256

      560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

      SHA512

      f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

      Download Submit

    • C:\Users\Admin\tooibu.exe
      Filesize

      180KB

      MD5

      6864f709c0ab250f79ac243eeb490424

      SHA1

      d889332d590f11e1f4fce9a3a702999c9a9e9e1c

      SHA256

      c50929756c04f1bca447056ac35ce4e46a2b8dab123cb094bb06d7977ec46803

      SHA512

      1b74375af4fa72c392a68d7b756e65a5eead0328df2fd70ebb50804d010c5d835a1841352286d7b5a73c79ada82ff8b5d07768ad192f8c112860057b09286d85

      Download Submit

    • memory/940-65-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/940-91-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/940-69-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/940-68-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/1052-62-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1052-63-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1052-64-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1052-88-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1052-60-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1356-55-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1356-57-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1356-56-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1356-53-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2012-52-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2012-82-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2012-47-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2012-50-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

      Download

    • memory/3412-84-0x0000000030670000-0x00000000306C1000-memory.dmp

      Filesize

      324KB

      Download