Overview

overview

10

Static

static

7

ee4bbfa607...18.exe

windows7-x64

10

ee4bbfa607...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee4bbfa607cafd2f483f9ca5fd43be08_JaffaCakes118.exe

  • Size

    672KB

  • MD5

    ee4bbfa607cafd2f483f9ca5fd43be08

  • SHA1

    d8ea7aca847676428df5c6031a096346c15eab52

  • SHA256

    d8398192701bdc50fda8a972c0bbb515d96638ccf33815f21f1db74ca39f4f93

  • SHA512

    0cfaae43f6eb569876832298e4ec45034e6cd38b5a78bc40c11bb13b85fe5ac24147a4e1cdbab67b39671874af1d6be88f3b70c247f5b7819d4948326b261b34

  • SSDEEP

    6144:luIL4XOrbL8uuTpsPHhhtQDdINgP2iMjz5qBHswNet4gjWlpkD51aIA:l7lr079s/hhtudFWJIHZNeygjW8D

Score
10/10
discoverypersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee4bbfa607cafd2f483f9ca5fd43be08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee4bbfa607cafd2f483f9ca5fd43be08_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\MSWINSCK.OCX
    Filesize

    121KB

    MD5

    e8a2190a9e8ee5e5d2e0b599bbf9dda6

    SHA1

    4e97bf9519c83835da9db309e61ec87ddf165167

    SHA256

    80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

    SHA512

    57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

    Download Submit

  • memory/2052-0-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

    Download

  • memory/2052-2-0x0000000002030000-0x00000000020B9000-memory.dmp

    Filesize

    548KB

    Download

  • memory/2052-7-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

    Download

  • memory/2052-10-0x000000000040B000-0x000000000040E000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2052-8-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

    Download

  • memory/2052-9-0x0000000002030000-0x00000000020B9000-memory.dmp

    Filesize

    548KB

    Download

  • memory/2052-23-0x0000000002030000-0x00000000020B9000-memory.dmp

    Filesize

    548KB

    Download

  • memory/2052-25-0x0000000002030000-0x00000000020B9000-memory.dmp

    Filesize

    548KB

    Download

  • memory/2052-26-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

    Download