Overview

overview

10

Static

static

3

f98d250c65...18.exe

windows7-x64

10

f98d250c65...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-09-2024 02:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f98d250c6525dda1479dfd22f6ed2210_JaffaCakes118.exe

  • Size

    24KB

  • MD5

    f98d250c6525dda1479dfd22f6ed2210

  • SHA1

    439c14c0315eb4350cc86e1774c163ff11e1c882

  • SHA256

    0f6f214bfd7a38fcf06fa75a28b217d8dab223acceb047b1b46fefe7489d170c

  • SHA512

    406db794183cfcdfac153104152df471c6364a29b9043cb59a461d396f62505ee1047de064bc621ec2fb621b5d9a957f83ed0c0897a760cc8f44e3b9a66ed7a4

  • SSDEEP

    384:/TX/af+PQqzIz0fa1WhIrI9bSLUPn7D9yXMD:/22Qq0ofaUhIE9mWnMX0

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f98d250c6525dda1479dfd22f6ed2210_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f98d250c6525dda1479dfd22f6ed2210_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Roaming\winserv.exe -a 15 -g yes -o pool.bitclockers.com:8332 -u eXawn -p m1kk3rz112
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\winserv.exe
    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

    Download Submit