Overview

overview

10

Static

static

3

eea1d45303...18.exe

windows7-x64

10

eea1d45303...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 23:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eea1d453034c098a90e627fad451a690_JaffaCakes118.exe

  • Size

    476KB

  • MD5

    eea1d453034c098a90e627fad451a690

  • SHA1

    d489bb79fa6428eb058e6c2fb5fa10c4c7285d8b

  • SHA256

    f316eb50db2f2109f5f9f4e6830a27eb067bf7d1afea18243e2fe56e0848b3eb

  • SHA512

    507a09761fcec73ce5d879f1fce3040a15ddda0a2edd35f3eaef0a93dcee06e9d863e3f20431b7ae95f0c2826b45e006da06cbbba847431856766db03c258280

  • SSDEEP

    12288:avUG/D2xKM+eM41dJ6X78TuJ8bHMU4yQ1OyB8yX:aMGr2QL41bF4b1LBbX

Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\eea1d453034c098a90e627fad451a690_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eea1d453034c098a90e627fad451a690_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Users\Admin\AppData\Local\Temp\svshost.exe
      "C:\Users\Admin\AppData\Local\Temp\svshost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2968
    • C:\Users\Admin\AppData\Local\Temp\svskost.exe
      "C:\Users\Admin\AppData\Local\Temp\svskost.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svshost.exe
    Filesize

    96KB

    MD5

    963d57c864b603b5e02281c78147f08b

    SHA1

    6bf1453ca4339a9b86a53b91c90fd1a8d1665e3f

    SHA256

    444875cebbd2cc50ef0051f76be48a687e91991179c0adc6235df1d33d7dde8c

    SHA512

    f5a7b5734f56d2d3a850a8c53b59c2f0b182928183fe43fd573931d4939d17227f16a22304eef69149a6dd959cdc4803db361490082acd123bc45ec76813c470

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\svskost.exe
    Filesize

    188KB

    MD5

    8ffb8ad41945a23f572f96dfb8bb9f10

    SHA1

    b9faf70a6f8ee20f6c673dd12e7d0fa649743e07

    SHA256

    443e9174f13f9471bf6e8473cbcc7c98bf61b379bedaec11e925c9559db4dc64

    SHA512

    57e0d131447dffa424a5cb0edc4c961358f1cd83f9d96eea8c7836b1372d866884745a41368a5af64a251d97b27cb279c8a92a8a434a29d7cc3079b236dd4b2c

    Download Submit

  • C:\Windows\SysWOW64\MSINET.OCX
    Filesize

    112KB

    MD5

    7bec181a21753498b6bd001c42a42722

    SHA1

    3249f233657dc66632c0539c47895bfcee5770cc

    SHA256

    73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31

    SHA512

    d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc

    Download Submit

  • C:\Windows\SysWOW64\MSWINSCK.OCX
    Filesize

    105KB

    MD5

    9484c04258830aa3c2f2a70eb041414c

    SHA1

    b242a4fb0e9dcf14cb51dc36027baff9a79cb823

    SHA256

    bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

    SHA512

    9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

    Download Submit

  • C:\Windows\SysWOW64\RICHTX32.OCX
    Filesize

    198KB

    MD5

    722435ba4d18f1704b43e823a12e489a

    SHA1

    48f3c6e2e14e397055b667e2c8baa85177eb6d44

    SHA256

    7d59a8cc7a5c16b3b0e0e67c65cf98c45158909f95ca3a5c96b946fdee42c095

    SHA512

    38fe59c3b38fb7593a695554ead9e56febc068057b8e1c4bb27b6af21f5f2e15ddcfabda2707a72edcedeaa8b0f172a05408b88ae8efff3d259277af03f7de04

    Download Submit