Overview

overview

10

Static

static

3

edceed80e8...18.exe

windows7-x64

10

edceed80e8...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    edceed80e838bae3262b2c0b9a1d1c45

  • SHA1

    3c622d0ca499d5e430b77e8ebf9a13f2a5bf9bf2

  • SHA256

    d6e821e4c976e8e76894feb1ca7379cbd2b0062108b98ec7a5a520b1b4d42aa1

  • SHA512

    756fd64c9250a1a49761e378ad19968250c5f7cb59f6686890924ed2fd903823169f62ba26b5e21ed5f3f3466b5caf3a43c64502ef47ecddfb57b1a88145e781

  • SSDEEP

    6144:AZUQoV86wYBQM/4ZVdNseBx0p9XbdVogK63rIzFjgf6dU:Tm61QMMpBx0DbdVO678G6dU

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 50 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:836
    • C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      2⤵
        PID:1972
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1112
      • C:\Users\Admin\AppData\Local\Temp\edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Users\Admin\azkns3n2.exe
          C:\Users\Admin\azkns3n2.exe
          3⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2476
          • C:\Users\Admin\kioiy.exe
            "C:\Users\Admin\kioiy.exe"
            4⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2188
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del azkns3n2.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2820
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2804
        • C:\Users\Admin\2nax.exe
          C:\Users\Admin\2nax.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Users\Admin\2nax.exe
            "C:\Users\Admin\2nax.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2632
        • C:\Users\Admin\3nax.exe
          C:\Users\Admin\3nax.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1852
        • C:\Users\Admin\4nax.exe
          C:\Users\Admin\4nax.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:800
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe
          3⤵
          • Deletes itself
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2296
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\system32\consrv.dll
      Filesize

      53KB

      MD5

      d1c9e07123216e8836e7988794cd3c75

      SHA1

      a1061c34544c9377449e186074404e0dd1009994

      SHA256

      334bd46d5f3ba098c11827982715c0ff98e2aa1c2361b9702b222949e7e5730c

      SHA512

      06014da3030fa66fbf64f9dd0c9c229390c93dedcb2c6f53aff810a7d0054c05c514804ea9dbae3d6ec1f13b45b4dd844a7e1ec1706e5a7ae16be8e8a760898b

      Download Submit

    • \??\globalroot\systemroot\assembly\temp\@
      Filesize

      2KB

      MD5

      1d11dbae1b4aaf44c7ab52a37d2563df

      SHA1

      f2e01282e5c09e8f21b4200aecb34ecd68875390

      SHA256

      1c236ce172f8d144d72c8853db59c532be9f84c4e3bb08735068fb5b30107aa4

      SHA512

      6fa95791a3a01688ba0cb0bcf5c09d0f1b0bff4671a4183f69ca5f5cc88db97ad3f8e09afb03bcae6b35b45b8ee76ed97d44c0f8c114abab4de305e0bd0b5397

      Download Submit

    • \Users\Admin\2nax.exe
      Filesize

      72KB

      MD5

      31816d7c0bbc877d8bf02407d56b91d8

      SHA1

      b700671049faa57edf172eb429cd37c5da884b0e

      SHA256

      aa20695052315cb4dd03190e93fd159b357c5786f5df80bca2ef7cb1a891063a

      SHA512

      cdd2b952d7209113fe80d38cc39b48adf9719c5fdf678f22d0c3c3af73a5ae96683e046dcbe4e170b3e76ea5462c30c06c9e34ece056ddfad81facfb01b9a4b0

      Download Submit

    • \Users\Admin\3nax.exe
      Filesize

      204KB

      MD5

      5477016057674f4f6aabf0e89111895c

      SHA1

      cc7f17d694b1c76a4222f21f914a1d1d1c7cd6e3

      SHA256

      65fbacd81e69966d322d20b3374cb16f1df40bf32f8ca0b1bac017bf4ee2938e

      SHA512

      b560c717b33157b77cc013c95f037a5d88167c6a1f3a8029ed6598aa9391f993c315c5365aa247c374cc77ab6d87ab607e0ca645b7a9e8e84779853f6a50a047

      Download Submit

    • \Users\Admin\4nax.exe
      Filesize

      44KB

      MD5

      947a34e363ca3072b304c68e68ea4fca

      SHA1

      542e7fdfa65109d14c70cf9559bfc49a1d092c45

      SHA256

      16d73c5ba3423dead5588fb645f839404c7f80503c85bf421e1fee4a52e17f79

      SHA512

      bcbb389556b2015019fd508abc59a17a652c1df66fae46591764e4050b317a776bccc79104f83e7e27602a43d5f19b394267e6964fc8099811942feea9678c51

      Download Submit

    • \Users\Admin\azkns3n2.exe
      Filesize

      252KB

      MD5

      70ae5750547219aed12660c41753f19e

      SHA1

      6c8779a695a026f06cd295b6ed6ce52174a4a2d4

      SHA256

      9e3e4d3b87fe1955a93eb96a45d0503a0d09e22c4478cd6953d3681b53944ef6

      SHA512

      08ee32315ea13e7e7f93aacce8c8aa5fa78207ba0996e06be672cbaced24f8c93e0b27bfe82e7964a6133a7964d35b5beaa902c4eb5f9e61169000d27ffc7689

      Download Submit

    • \Users\Admin\kioiy.exe
      Filesize

      252KB

      MD5

      71316ccb3b76c509c35eefd630742ec6

      SHA1

      3e077bdbeba23e9ced6fe54e50e922b071e33de6

      SHA256

      fa5d0bf68045cb2625771934809e36549bbaccbe33a6df7ee21aaac3980f4f85

      SHA512

      697334473dd85356f61594a5c7accbb1071494bf0cd5e7572b2882340fa7f7012bf344a0d0ad46c929460426949c5574a2acc2d73ebe8e3079f978639551ab2e

      Download Submit

    • memory/336-77-0x0000000002380000-0x0000000002392000-memory.dmp

      Filesize

      72KB

      Download

    • memory/336-105-0x0000000002380000-0x0000000002392000-memory.dmp

      Filesize

      72KB

      Download

    • memory/836-116-0x0000000000C70000-0x0000000000C7B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/836-115-0x0000000000C60000-0x0000000000C6B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/836-111-0x0000000000C60000-0x0000000000C6B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/836-107-0x0000000000C60000-0x0000000000C6B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1112-61-0x0000000002500000-0x0000000002506000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1112-65-0x0000000002500000-0x0000000002506000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1112-69-0x0000000002500000-0x0000000002506000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2476-28-0x0000000003A30000-0x00000000044EA000-memory.dmp

      Filesize

      10.7MB

      Download

    • memory/2632-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2632-50-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/2632-51-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/2632-49-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/2632-41-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/2632-43-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/2632-48-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/2632-39-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/2732-75-0x0000000030670000-0x00000000306A3000-memory.dmp

      Filesize

      204KB

      Download

    • memory/2732-60-0x0000000030670000-0x00000000306A3000-memory.dmp

      Filesize

      204KB

      Download