Overview

overview

10

Static

static

3

edceed80e8...18.exe

windows7-x64

10

edceed80e8...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    edceed80e838bae3262b2c0b9a1d1c45

  • SHA1

    3c622d0ca499d5e430b77e8ebf9a13f2a5bf9bf2

  • SHA256

    d6e821e4c976e8e76894feb1ca7379cbd2b0062108b98ec7a5a520b1b4d42aa1

  • SHA512

    756fd64c9250a1a49761e378ad19968250c5f7cb59f6686890924ed2fd903823169f62ba26b5e21ed5f3f3466b5caf3a43c64502ef47ecddfb57b1a88145e781

  • SSDEEP

    6144:AZUQoV86wYBQM/4ZVdNseBx0p9XbdVogK63rIzFjgf6dU:Tm61QMMpBx0DbdVO678G6dU

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\azkns3n2.exe
      C:\Users\Admin\azkns3n2.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Users\Admin\lbjaag.exe
        "C:\Users\Admin\lbjaag.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del azkns3n2.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:444
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:680
    • C:\Users\Admin\2nax.exe
      C:\Users\Admin\2nax.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:372
      • C:\Users\Admin\2nax.exe
        "C:\Users\Admin\2nax.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:5008
    • C:\Users\Admin\3nax.exe
      C:\Users\Admin\3nax.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:4104
      • C:\Users\Admin\4nax.exe
        C:\Users\Admin\4nax.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4016
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3456

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\2nax.exe
      Filesize

      72KB

      MD5

      31816d7c0bbc877d8bf02407d56b91d8

      SHA1

      b700671049faa57edf172eb429cd37c5da884b0e

      SHA256

      aa20695052315cb4dd03190e93fd159b357c5786f5df80bca2ef7cb1a891063a

      SHA512

      cdd2b952d7209113fe80d38cc39b48adf9719c5fdf678f22d0c3c3af73a5ae96683e046dcbe4e170b3e76ea5462c30c06c9e34ece056ddfad81facfb01b9a4b0

      Download Submit

    • C:\Users\Admin\3nax.exe
      Filesize

      204KB

      MD5

      5477016057674f4f6aabf0e89111895c

      SHA1

      cc7f17d694b1c76a4222f21f914a1d1d1c7cd6e3

      SHA256

      65fbacd81e69966d322d20b3374cb16f1df40bf32f8ca0b1bac017bf4ee2938e

      SHA512

      b560c717b33157b77cc013c95f037a5d88167c6a1f3a8029ed6598aa9391f993c315c5365aa247c374cc77ab6d87ab607e0ca645b7a9e8e84779853f6a50a047

      Download Submit

    • C:\Users\Admin\4nax.exe
      Filesize

      44KB

      MD5

      947a34e363ca3072b304c68e68ea4fca

      SHA1

      542e7fdfa65109d14c70cf9559bfc49a1d092c45

      SHA256

      16d73c5ba3423dead5588fb645f839404c7f80503c85bf421e1fee4a52e17f79

      SHA512

      bcbb389556b2015019fd508abc59a17a652c1df66fae46591764e4050b317a776bccc79104f83e7e27602a43d5f19b394267e6964fc8099811942feea9678c51

      Download Submit

    • C:\Users\Admin\azkns3n2.exe
      Filesize

      252KB

      MD5

      70ae5750547219aed12660c41753f19e

      SHA1

      6c8779a695a026f06cd295b6ed6ce52174a4a2d4

      SHA256

      9e3e4d3b87fe1955a93eb96a45d0503a0d09e22c4478cd6953d3681b53944ef6

      SHA512

      08ee32315ea13e7e7f93aacce8c8aa5fa78207ba0996e06be672cbaced24f8c93e0b27bfe82e7964a6133a7964d35b5beaa902c4eb5f9e61169000d27ffc7689

      Download Submit

    • C:\Users\Admin\lbjaag.exe
      Filesize

      252KB

      MD5

      b9d7c961ca158d3c3af9eeed9abea72a

      SHA1

      49437ee9824fe1d0f33d3578e7813de43ab40ba5

      SHA256

      b03ff67f4cee1cd587f147f38e0c4c52e73de4f022f626c1230514ccb08d6983

      SHA512

      13ddb5d083785341603d6ef91d20a99075ce40a8cff3c584dd6c4145b081ac3fa3a9113e52aa916e2d6521c640fd9c9caab3078478dec2c4e75f9bb1a6bb7c57

      Download Submit

    • memory/220-58-0x0000000030670000-0x00000000306A3000-memory.dmp

      Filesize

      204KB

      Download

    • memory/220-59-0x0000000030670000-0x00000000306A3000-memory.dmp

      Filesize

      204KB

      Download

    • memory/5008-47-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/5008-50-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/5008-51-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/5008-53-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

      Download