Overview

overview

10

Static

static

7

ed986e8e78...18.exe

windows7-x64

10

ed986e8e78...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 12:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe

  • Size

    8.9MB

  • MD5

    ed986e8e78df8348ae9392d9d05e33fc

  • SHA1

    c021eed9fa6306544af387b298e7fe56c7cf0eae

  • SHA256

    cd6ce7b122e7cbde696a16dad93a16a62d04fe1a4c4309cea3127a0c31be5232

  • SHA512

    2255775236aa859e1e4b72783de68d93b7154f66e3fdce7601daaceab2737a5a731ec0b1cf13e49f964962928c7a72f3afd664f1dca4db3d6e95b3ad5fc41ee9

  • SSDEEP

    196608:i7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXlAryfEQulen8c:i7effIPEsy58doQaTxLhQyZbIly38do7

Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 4 IoCs
  • Sets service image path in registry 2 TTPs 3 IoCs
    persistence
  • ACProtect 1.3x - 1.4x DLL software 5 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4628
      • C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
        3⤵
        • Enumerates connected drives
        PID:2772
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:4108
    • C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\ed986e8e78df8348ae9392d9d05e33fc_JaffaCakes118.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    1KB

    MD5

    7fb5fa1534dcf77f2125b2403b30a0ee

    SHA1

    365d96812a69ac0a4611ea4b70a3f306576cc3ea

    SHA256

    33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

    SHA512

    a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    436B

    MD5

    971c514f84bba0785f80aa1c23edfd79

    SHA1

    732acea710a87530c6b08ecdf32a110d254a54c8

    SHA256

    f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

    SHA512

    43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    174B

    MD5

    d8e44b1e7c38846fa81243877bf6133c

    SHA1

    cfd0d3db3b1c68d72ce1643ba26bdcecca17caba

    SHA256

    0a3cc3edd7620abd744dd161a63d7169b4cb437ac9b8ec9ec92ff6b3f775520f

    SHA512

    a3a1f43c50f3834a88b5bdd8897d1fbb9f2a775ba1d59669de1c38476bbbf095d0f31a62b7048fac48d09bc4072742984b891601286151ae8190a97879ab9bb0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    170B

    MD5

    bd95dd2528bd9f60b4c54573df99a8f9

    SHA1

    d6b51618370f073a371406bc2b73316a9b940928

    SHA256

    69dd1c7883e47084edd99c29a9d3d560d32767dcde9f11a05923d6ed5ffb8e0c

    SHA512

    2a1204db607103a7c1290852263e3c6b85475f0e92305a21eb144a9cad09481c99516c2e1eba73551c5e50ee25acf81bc0b293ce3c98aab48d81ec9035da743a

    Download Submit

  • C:\Users\Admin\AppData\Local\cftmon.exe
    Filesize

    8.9MB

    MD5

    1dc610307fcbeec1e04b35d35f60513b

    SHA1

    2aa23ac61e9728883b633af02bc44908af043520

    SHA256

    87d2d21a293c02a7e5570cee5284e7f1cc46e99a29cfb427412c4671326e3194

    SHA512

    b9d3ed7ac43e4b96aa571aabc8afbdaa573a6da56caa6ad966a57b5da2856d3d2036cbc2fd0b1f0b8c3bedaa528360cb47edb49f6fcda6ad2cb34ccb4ae27711

    Download Submit

  • C:\Windows\SysWOW64\drivers\spools.exe
    Filesize

    8.9MB

    MD5

    267cecb60883e2b1efcef63b0a7bd60e

    SHA1

    798350cca77dfa53b898b76c57c8ede168991ea8

    SHA256

    fc14288f43f4fa3b5e11118ee790bbe28bb724490b3bb87d6be49761c1cf9ade

    SHA512

    196827faab0f79523a706c55c2f0ac02dffa1f043711b6ebc61c113388718fe5117ed962eab1b579ecb5fb0bddec437df802c09d1d17ece34bc4715cbd580124

    Download Submit

  • C:\Windows\SysWOW64\ftpdll.dll
    Filesize

    5KB

    MD5

    d807aa04480d1d149f7a4cac22984188

    SHA1

    ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

    SHA256

    eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

    SHA512

    875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

    Download Submit

  • memory/1016-45-0x0000000010000000-0x000000001010B000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1016-44-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/2772-46-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/4132-32-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/4360-33-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/4628-30-0x0000000010000000-0x000000001010B000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/4628-31-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/4972-0-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/4972-14-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/4972-15-0x0000000010000000-0x000000001010B000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/4972-12-0x0000000010000000-0x000000001010B000-memory.dmp

    Filesize

    1.0MB

    Download