Overview

overview

7

Static

static

5

2b300b6367...18.exe

windows7-x64

7

2b300b6367...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 04:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b300b6367cf28e629383da294f838df_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    2b300b6367cf28e629383da294f838df

  • SHA1

    7a1f3aef12cceeb1bd2896a5af4eaf30283a7968

  • SHA256

    e4b37192e45f66509974c027c0c215eb41c460e0f1cf4d5af96c04c177dbb5a9

  • SHA512

    44c441253f78378e62bddec515689d65b1888fec7ba083afe4422c84c21794547f4f2e8835ff905893104a6c698eda0237069965fe9884aafb9f825954c4f0d9

  • SSDEEP

    768:kKTgr5vJB45jYJyVhfpd++pCeS/TKvYm8gld7Fn:k8yvn45ZD3pCzTKB/Bn

Score
7/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b300b6367cf28e629383da294f838df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2b300b6367cf28e629383da294f838df_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2B300B~1.EXE >> NUL
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\EN7hzSreCat8.dll
    Filesize

    221KB

    MD5

    a36965ec36ae0c233443dc28ed8708a8

    SHA1

    46f94394e01400aacf3b49f21910dfde14f072a1

    SHA256

    6d05207418c6a6f8ed8360ccec45b57a2ecd957e6e7c9e285340ac8ff71ed9d3

    SHA512

    1c44c8235aece6f2ec19e745b03b333f47fe332d85b97e37c148cea4693bc54ee2cb3978a9a60d0186576c7cad3a304e35708b2843e818d01aab70fc26f12a81

    Download Submit

  • memory/2468-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2468-10-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

    Download

  • memory/2468-13-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2468-14-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

    Download