Overview

overview

10

Static

static

5

04cd640e74...18.exe

windows7-x64

10

04cd640e74...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04cd640e7410608a2431748c86cda646_JaffaCakes118.exe

  • Size

    17KB

  • MD5

    04cd640e7410608a2431748c86cda646

  • SHA1

    16c486a32f0a43eeb8705600c108570fbb1a37d0

  • SHA256

    09ae7271c958773d1f2e7c32344c14b744b54e84bd4fe54edcf681fd660be347

  • SHA512

    51f7dd044ae51b651d9a4d0e86aab53b233d0eda95682053dc8974c5076ef791bcaaead45b475cd298fcc820ab8ef7c43d86ccc4ac2b973588f72ab6d9be7bab

  • SSDEEP

    384:GOdmqUQPMgEXh9qg0qT+91piJ0QcrjJDvPc2nf4:GOiuMag/K9SJeRPc2f

Score
10/10
discoverypersistenceupx

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04cd640e7410608a2431748c86cda646_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04cd640e7410608a2431748c86cda646_JaffaCakes118.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Windows\fonts\mtbbpxpf.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4724
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\04CD64~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Fonts\mtbbpxpf.dll
    Filesize

    60KB

    MD5

    53adaec2b442ed8cda371fbca3af0502

    SHA1

    b7a4786eecb3c00200a481d526129caa8aca41d2

    SHA256

    05ff0b8ab0136670872c1a0325f5c25d0109147a60854fc54697dc6e25524ac1

    SHA512

    5482e293505584bbd01231cdde59443d19335fa1293c34f775e2f474afc308c09c8c602a184d6a0b8e2a480159746dccb52245678dba28e76aa01caced405dc4

    Download Submit

  • memory/620-0-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/620-9-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/620-10-0x0000000010000000-0x00000000105D0000-memory.dmp

    Filesize

    5.8MB

    Download

  • memory/620-17-0x0000000010000000-0x00000000105D0000-memory.dmp

    Filesize

    5.8MB

    Download

  • memory/4724-8-0x0000000010000000-0x00000000105D0000-memory.dmp

    Filesize

    5.8MB

    Download