Overview

overview

7

Static

static

3

0b8922089d...18.exe

windows7-x64

7

0b8922089d...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 16:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0b8922089dea70d47c6d660270dda534_JaffaCakes118.exe

  • Size

    369KB

  • MD5

    0b8922089dea70d47c6d660270dda534

  • SHA1

    d07aee59fde418c6c2781d787e460dafa911a35a

  • SHA256

    661d202ea727e900db3d9a5ed04c9a5b95eefd7027eada19cdd39128c05c99e2

  • SHA512

    a74eec371a6ec4993bd334ab86d29dfd3f7735536edeb14d4657c3af0106a5492549654697590abcd57e4e8dae8863b3a4949cf46d5d0255e7a1c5603df32065

  • SSDEEP

    6144:AV93E4CqizksVeG0+UkKuKH94rJHIw/koiaIirL4mR/RL9d0DhrYJLXpu:29HCZIgeGlVKj6VIvMIyTR/GhgLX

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b8922089dea70d47c6d660270dda534_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0b8922089dea70d47c6d660270dda534_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\ProgramData\fFiLiLeDfIa10400\fFiLiLeDfIa10400.exe
      "C:\ProgramData\fFiLiLeDfIa10400\fFiLiLeDfIa10400.exe" "C:\Users\Admin\AppData\Local\Temp\0b8922089dea70d47c6d660270dda534_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\fFiLiLeDfIa10400\fFiLiLeDfIa10400.exe
    Filesize

    369KB

    MD5

    a556d07b20060aee0e0a7e6bba3483fc

    SHA1

    b4c1d85eaa12d6148ab435c5a6bd4c63cee42a71

    SHA256

    d41b5090fac8988df711517e85a6c826b075303d62a96269c633774272d687a1

    SHA512

    c7b2ab7333e4bae390518fb49386b03d62fd515414e8d41213ecba115b65cb20a65211ab26d3f805c885492dda24b383901025dbbf543a55f1c0678becde4f0b

    Download Submit

  • memory/1028-12-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1028-19-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1028-32-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/4408-1-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4408-2-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/4408-17-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/4408-18-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/4408-49-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/4408-50-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

    Download