Overview

overview

7

Static

static

3

084c15a1fe...18.exe

windows7-x64

7

084c15a1fe...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 01:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    084c15a1fe1ab413bd5f430752513122_JaffaCakes118.exe

  • Size

    428KB

  • MD5

    084c15a1fe1ab413bd5f430752513122

  • SHA1

    50f257a7e13a1b3f8843d10a2306ca5109ab230f

  • SHA256

    f5a347fdaf5b0a30b079646ec977d3c3bfd4e827102cf7d8594d5cec9dd4ac28

  • SHA512

    9584072897f6388de8abb61a0d049c6f599351d14ade24938a9dd0cef4a9df74e0926f629b40e259b2c40ff0b372f1d3deea031ad191cc5977e0a7d69244d775

  • SSDEEP

    12288:wsjggL9Lt2nv7xdzzb8fGNO8igRKhnUATl/e:wiLkv/X8Ooi47Tl/

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\084c15a1fe1ab413bd5f430752513122_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\084c15a1fe1ab413bd5f430752513122_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\ProgramData\bAc01812iHmNn01812\bAc01812iHmNn01812.exe
      "C:\ProgramData\bAc01812iHmNn01812\bAc01812iHmNn01812.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:944
    • C:\ProgramData\bAc01812iHmNn01812\bAc01812iHmNn01812.exe
      "C:\ProgramData\bAc01812iHmNn01812\bAc01812iHmNn01812.exe" "C:\Users\Admin\AppData\Local\Temp\084c15a1fe1ab413bd5f430752513122_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\bAc01812iHmNn01812\bAc01812iHmNn01812
    Filesize

    192B

    MD5

    b184acdbe30ba9412b0a29cb97d8fd50

    SHA1

    638021de7946afa911262b288c88df81cd81fdd2

    SHA256

    b6a94301ee65c024fded2ae05f869d95c8b8a1c11de9ea2328ef2da96591d9dd

    SHA512

    cfaa2030952ec0b5271920cca3a525f3e881b27746b52f6bc8ee91393bf99bc6bc15c6bcf08e1fb7a0d47390cefbd1daf2fba2150b477e8f6a6c8ea7d60c614a

    Download Submit

  • C:\ProgramData\bAc01812iHmNn01812\bAc01812iHmNn01812
    Filesize

    192B

    MD5

    b1fd91f2a0cff1b23c0d221e955a4797

    SHA1

    d6c000c2686be062c23ef823b72c7653ca63f760

    SHA256

    65b894f190013bf9a9710f75acd2020a3e4f541a3227955463e335e9eeb746de

    SHA512

    6d6c0423f0f8a31bf4b04786ccc6c838d4001737f56686ddc359aa245eb2c530a4b771ac7009edc3d7507cf658a4c231f57f758c274230d28322777bb3613476

    Download Submit

  • \ProgramData\bAc01812iHmNn01812\bAc01812iHmNn01812.exe
    Filesize

    428KB

    MD5

    084c15a1fe1ab413bd5f430752513122

    SHA1

    50f257a7e13a1b3f8843d10a2306ca5109ab230f

    SHA256

    f5a347fdaf5b0a30b079646ec977d3c3bfd4e827102cf7d8594d5cec9dd4ac28

    SHA512

    9584072897f6388de8abb61a0d049c6f599351d14ade24938a9dd0cef4a9df74e0926f629b40e259b2c40ff0b372f1d3deea031ad191cc5977e0a7d69244d775

    Download Submit

  • memory/944-24-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/944-31-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/2084-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2084-1-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/2084-40-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/2084-70-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/2896-33-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/2896-41-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/2896-55-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download