Overview

overview

10

Static

static

3

fc7f63ccd8...18.exe

windows7-x64

10

fc7f63ccd8...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-09-2024 14:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    fc7f63ccd826f0bed675aac69a0969d3

  • SHA1

    8bb1e89f1080e272cd77e2a08933a9daf3d9db85

  • SHA256

    ccd9dd1098157c884c04bc46825b296607774534e5c4200b856b28a13e03f365

  • SHA512

    1f661e13ccf40e8321abdf9344a8dc3600c2ec41fbac7be301eaeb381e8d8302565570383c226b34b71a3e020ed5a13a93018a8729db7e8f3e67e52d1019b192

  • SSDEEP

    49152:6/H9zPqoEUP/QsGDFxUGXET3pb2uQUr3ZAK6SQKS:gHZhgFxUfT3gu3r3ZAn

Score
8/10
discoverypersistenceupx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Windows\SysWOW64\Cloud AV 2012v121.exe
      C:\Windows\system32\Cloud AV 2012v121.exe 5985C:\Users\Admin\AppData\Local\Temp\fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Users\Admin\AppData\Roaming\rzP0ycS1iDoGaHs\Cloud AV 2012v121.exe
        C:\Users\Admin\AppData\Roaming\rzP0ycS1iDoGaHs\Cloud AV 2012v121.exe 5985C:\Windows\SysWOW64\Cloud AV 2012v121.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3672
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\ahst.lni
    Filesize

    612B

    MD5

    49c1ab1dd5c8c51986245936e8fb64e6

    SHA1

    041652a0015f1c0742e6a6dac138c23ec294ab5f

    SHA256

    2e1a5cccce9889f258b9573db15d14758aa5e91d85241375eea1399becd700a8

    SHA512

    e79a079c45fb91aa6be65967468ac66396a60fa3c03c2146b7e63dd40a57316560cf6990a6903a0f763238df3506057cb3caeb114049e580a793d934aad93140

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ahst.lni
    Filesize

    1KB

    MD5

    67530d412a3d4fe26bead726ea39083f

    SHA1

    0c3228a99dd73418e47ffa8eebaa12aeb3298868

    SHA256

    5dbbbd779695b6e53f79203efcb1ae8cc22097e339287a8cd34929784e5e82e4

    SHA512

    2ade08eee054c117767c5ede5b6edd933eb45d87a1cf475ab379b8388a58100b6478050d236f3e8d39822e579f02db044bdad2ad628779ce93e6d930f58bf97e

    Download Submit

  • C:\Windows\SysWOW64\Cloud AV 2012v121.exe
    Filesize

    1.9MB

    MD5

    fc7f63ccd826f0bed675aac69a0969d3

    SHA1

    8bb1e89f1080e272cd77e2a08933a9daf3d9db85

    SHA256

    ccd9dd1098157c884c04bc46825b296607774534e5c4200b856b28a13e03f365

    SHA512

    1f661e13ccf40e8321abdf9344a8dc3600c2ec41fbac7be301eaeb381e8d8302565570383c226b34b71a3e020ed5a13a93018a8729db7e8f3e67e52d1019b192

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    51fc10f3256bce3376cb579a6c222fda

    SHA1

    4fc1f93f5bb319431957454f0b5da0305c6d956e

    SHA256

    fad1ba61af982646aadc990662bf26e874c325e48b1bdfaea589b18803bcb740

    SHA512

    609d943f425e255604c19bc341d6905fd66230359b705f6c3207b515a55502c0513212992e59239f3661cf26375a5a56c7748518e3a0cd330821eae359b02ea3

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    88059ae1e846d058a259714b0abcca4e

    SHA1

    3b3a5ac74228d6a48d52b92896262a78ea706896

    SHA256

    a535511541bf82de1ee0004e03485c39fc689d56cda3cbc7164557c155525ddd

    SHA512

    0c480f1ea2b0d73523fbc58becb78052d9b89735a889afabd9eac559fa7d70517c12fb6dfe8a947d9a1e7c58780a41be7a7001082c5168a2800c263c6c620cbf

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    5b8ca13f53960a93f94b08fd9f202e18

    SHA1

    00bd9fc9b1ac0f88bbf90d0026d394771bb39aa6

    SHA256

    541a690d5fc104d3ffe59e400627789d49a481070815f403074b1e205ffa7ec3

    SHA512

    6d738543b489be0cbebca00cd672d48ac83c7c297c4721cba79cac923d9ef43b32c7847b29d79fa8dccd9c5d5501615f494fc8e208d4186e8eeed476553a6e8e

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    50ab0dd716dd66ad0c3eb5fb63f2f118

    SHA1

    bd9641078264b2135d3b3b0007c98f977d057960

    SHA256

    1f9037b078250201c92f8e1ea1ad3023011039c76a5aa74d3710edc452fc6517

    SHA512

    24c0b8ca8650fb50f81b9a89bbb7e8e5492b303b065fbf846c55aeb76c9fc41ebb5b9c6163d168a1362941720473486fdf2596dab4764176ebb348ad264b61d6

    Download Submit

  • memory/3144-1-0x0000000000400000-0x0000000000914000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3144-9-0x0000000000400000-0x0000000000914000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3144-8-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3144-2-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3472-18-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3472-12-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3472-11-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3672-90-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3672-101-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3672-112-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/3672-123-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download