Overview

overview

10

Static

static

7

ed0ac3ec75...18.exe

windows7-x64

10

ed0ac3ec75...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 06:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed0ac3ec754cb2fa9cb4513394316573_JaffaCakes118.exe

  • Size

    246KB

  • MD5

    ed0ac3ec754cb2fa9cb4513394316573

  • SHA1

    05564f7f4d5d05511346fd855b7dc7b2e67fb16b

  • SHA256

    d3f488cbb6fa9c76667767180c1486e285aa923040a3ec849d85b7be682a161b

  • SHA512

    461775058079e11587e5c931906aeff2c080db0e13a721522a09f1adfd7044bf561b744c86fb3c3f2872086b136907a1586e04392a8027d5eaed6766fcccaafc

  • SSDEEP

    6144:guMJWY+qaHEQCcYfSBYJbQCjRcqESEgm6Anhc1kG6Evy:g+YcUc6SBLLTSEgBAnhc1kG

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed0ac3ec754cb2fa9cb4513394316573_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed0ac3ec754cb2fa9cb4513394316573_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C AT /delete /yes
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\at.exe
        AT /delete /yes
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2208
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\WORD.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Windows\SysWOW64\at.exe
        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\WORD.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2684
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2876
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x5b0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3028
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1388
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1880
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2052
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:2828
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1092
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2480
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2308
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:680
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2128
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1764
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:1524
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:2444
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3020
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2972
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:2392
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2924
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2476
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2400

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Windows\SysWOW64\WORD.exe
                    Filesize

                    246KB

                    MD5

                    ed0ac3ec754cb2fa9cb4513394316573

                    SHA1

                    05564f7f4d5d05511346fd855b7dc7b2e67fb16b

                    SHA256

                    d3f488cbb6fa9c76667767180c1486e285aa923040a3ec849d85b7be682a161b

                    SHA512

                    461775058079e11587e5c931906aeff2c080db0e13a721522a09f1adfd7044bf561b744c86fb3c3f2872086b136907a1586e04392a8027d5eaed6766fcccaafc

                    Download Submit

                  • memory/1140-18-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-20-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-13-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-14-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-15-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-16-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-12-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-17-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-19-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-0-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-21-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-22-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-23-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-24-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-25-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download

                  • memory/1140-26-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                    Download