Overview

overview

7

Static

static

3

ef23f9f34d...18.exe

windows7-x64

7

ef23f9f34d...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 05:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ef23f9f34d3ae0eaa76d736d7c742c74_JaffaCakes118.exe

  • Size

    60KB

  • MD5

    ef23f9f34d3ae0eaa76d736d7c742c74

  • SHA1

    0d4eee1fca935deedfce15da47ed76ed3f7264c8

  • SHA256

    b59bc24a295a92959a3113b54e67d07d5b496dcd6366fad2d68c58b1988d5e82

  • SHA512

    9773977163519a11e3dcd2b5cdec8b2c981d3728c9bdcef5d5a4f966f36bf37968ba93e95022f6278de3f378766da3c54d891d2db3b59e7a454d6168a090d0c2

  • SSDEEP

    384:SbJ3wiMuNPJeD7lB8DurwRFHhMUUW6/URR4fxJeDnDpewO75urV7FHqL6Adiws9m:K3wgE8DurQhMUUmR+weLurbI6Ad5sM

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef23f9f34d3ae0eaa76d736d7c742c74_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef23f9f34d3ae0eaa76d736d7c742c74_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2372

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\svchost.exe
          Filesize

          28KB

          MD5

          f4a17fff2381a11a5443d57277b8f268

          SHA1

          aecd77b69adc8a5626720df0cba23177b772ff7f

          SHA256

          b6a24ae56f7c79c0876e060a351a927bb584ef4514e26c64ec0dee50126f3bb7

          SHA512

          cf42a1fa4201e25f45d330cbae9b302650c94cacc8431b48eb9ce4ae3aeb1d851853d499ab8d58e71957b4ab36325ee3d3bc904968017c968e948251f16476c9

          Download Submit