Overview

overview

10

Static

static

3

393c92d44c...18.exe

windows7-x64

10

393c92d44c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2024 09:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    393c92d44cd92289900e6fc5d6b1eb22_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    393c92d44cd92289900e6fc5d6b1eb22

  • SHA1

    ec44af8dc341e234905f729008f0feaeaee504f4

  • SHA256

    9f7eeb42386db8b2afa33bd0d5bf4e64d2ac99ced6d42bfc0d00b4bf20a4752d

  • SHA512

    e848e2ed11e3e4f47627c58e7b74195856d76beff22406ff78599e1dcc4a1f1bc2a478cb5ccb83876290119965ad348d00c3c9cc72247ab78657071c877b5ee7

  • SSDEEP

    3072:QcO26I+5tPj5xqJFcoP8PdIuG8UvahsdcYX3UI2EuJ3im/ZCdady+RlTp/VYq63W:QT7zG2PBUyhsdEI2++M+RlTHYW

Score
10/10
discoverypersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\393c92d44cd92289900e6fc5d6b1eb22_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\393c92d44cd92289900e6fc5d6b1eb22_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\393c92d44cd92289900e6fc5d6b1eb22_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\393c92d44cd92289900e6fc5d6b1eb22_JaffaCakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\MSWINSCK.OCX
    Filesize

    121KB

    MD5

    e8a2190a9e8ee5e5d2e0b599bbf9dda6

    SHA1

    4e97bf9519c83835da9db309e61ec87ddf165167

    SHA256

    80ab0b86de58a657956b2a293bd9957f78e37e7383c86d6cd142208c153b6311

    SHA512

    57f8473eedaf7e8aad3b5bcbb16d373fd6aaec290c3230033fc50b5ec220e93520b8915c936e758bb19107429a49965516425350e012f8db0de6d4f6226b42ee

    Download Submit

  • memory/2948-3-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

    Download

  • memory/4400-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/4400-2-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download