Overview

overview

7

Static

static

3

f6521cb71d...18.exe

windows7-x64

7

f6521cb71d...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 15:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6521cb71dda082388d92ff7ba85eeb5_JaffaCakes118.exe

  • Size

    418KB

  • MD5

    f6521cb71dda082388d92ff7ba85eeb5

  • SHA1

    8f0fcca1636c3a48bc79fe1d3aee271006ec49c4

  • SHA256

    1a41930c190b7f8040503fd9865de9d07929bef93d84b339a9b174a43d0a74e0

  • SHA512

    5fb6c8ff30daffd63a0696a795dcff74ff57fa7071000553b7be72163187c3060a35bf057923252e619a8559215b1c034576b2b33f3ab89a38ef0e84b406eeb3

  • SSDEEP

    6144:x1LDhBEUQ2G7E+udcoPv5n68ucAIRRNSoNbh9tjyqhDzyBkfTT9MQrFbF4mp:x1fhtQYh6VcASRNSUt9QifTT2QrP4

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6521cb71dda082388d92ff7ba85eeb5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f6521cb71dda082388d92ff7ba85eeb5_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\ProgramData\dEd21500nJoCd21500\dEd21500nJoCd21500.exe
      "C:\ProgramData\dEd21500nJoCd21500\dEd21500nJoCd21500.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2712
    • C:\ProgramData\dEd21500nJoCd21500\dEd21500nJoCd21500.exe
      "C:\ProgramData\dEd21500nJoCd21500\dEd21500nJoCd21500.exe" "C:\Users\Admin\AppData\Local\Temp\f6521cb71dda082388d92ff7ba85eeb5_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\dEd21500nJoCd21500\dEd21500nJoCd21500
    Filesize

    192B

    MD5

    778eedfe2a5997cc1fb465f2f78de9c3

    SHA1

    2b0012582be1692a1861a1fccdc397b59faedcc8

    SHA256

    b089655e041054e07f9013e942dfe6c88cf27833b81585c373aa47e7090268ee

    SHA512

    98a5179b0186e0ca71a4207a044de7cf72424eac3ecb95e2627f72afe37e787a1a32b652b8d9ba4e05532fad6193e3404e113e28446c45148ae23bcce4f63364

    Download Submit

  • C:\ProgramData\dEd21500nJoCd21500\dEd21500nJoCd21500
    Filesize

    192B

    MD5

    7d14f79b318eeb1bc43fc12504700d23

    SHA1

    e8ee4922b30b25decdd6ce100f660cc26366c2dc

    SHA256

    e78fe665ae16a4f8316cf1e29cc47438941af715c4373a8ed8500eae31cfa165

    SHA512

    1a8dd3768532d9926f1da36a216478c5fe08ad1f6f5ed3c4a76539b9bd045615563b027846759eb463fd87a5d8023bb9e574e5db3724306ca6dc8f61239a870c

    Download Submit

  • \ProgramData\dEd21500nJoCd21500\dEd21500nJoCd21500.exe
    Filesize

    418KB

    MD5

    215f6576fac89de73e5e87a8d8c626ff

    SHA1

    3b26aeffc9af5d60869d8904e8a021bca009b012

    SHA256

    1720cacbfeb9328f3cf0b4e287a02927dc282a3dc82da8f51da343149a03ce75

    SHA512

    44922138a1d483f2d4bde4d759ba45ac41307b046c9550177f1281e6f5a32917b3e409f776d6b8dd57d4455dbbf6680eb689ca4a479a916dc78136d8491fcf35

    Download Submit

  • memory/2148-0-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2148-3-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2148-26-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2712-15-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2712-23-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2824-29-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2824-36-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2824-45-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download