Overview

overview

7

Static

static

3

426793ca86...18.exe

windows7-x64

7

426793ca86...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 12:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe

  • Size

    126KB

  • MD5

    426793ca868ec84f26bf54e08cb988f0

  • SHA1

    5a27af370c442304f24ef3e02bee001371083199

  • SHA256

    ce08ff273c2a52e3abd62da4d77e879553efeb7f6533574b8aa2a21345436d2f

  • SHA512

    cb1d2b53fab6c6bf113546e9fcd73b72074d009a23d091d984742f660b8634b7f90dede7dfa0c6519746d520b5a34db841e6e358ef8dff2011101389abd93820

  • SSDEEP

    3072:2He3m89edLyQbDPyIdcYpXddbVbuvHqEmN2H2sJeeEJUaLhMiRUZTCJp:HMcKX2HqTN42sJenIiRX

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_jaffacakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_jaffacakes118.exe" C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4664
    • C:\program files (x86)\adobe\acrotray.exe
      "C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\program files (x86)\adobe\acrotray.exe
        "C:\program files (x86)\adobe\acrotray.exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:112
      • C:\program files (x86)\adobe\acrotray .exe
        "C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\program files (x86)\adobe\acrotray .exe
          "C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\426793ca868ec84f26bf54e08cb988f0_JaffaCakes118.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:8
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:636
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4712 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:224
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4712 CREDAT:17416 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4596
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4712 CREDAT:17424 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\acrotray.exe
    Filesize

    152KB

    MD5

    f3b26541da3f6fb9d754b08aaab549c2

    SHA1

    af7f75c1437bbd374ce64bd613fb0edeffb711de

    SHA256

    9e205c8696fca9506e3a2e4dd2f0aec81fd871dbfe57d4a455dfdc138c2c6868

    SHA512

    d609aa998acdb42cb01bd4b80496786809b42e09ca0f222844f70c583951968fec15f88933c0e2907601454fd9ca55fc4ee73754351789b994fb962fbb4170f1

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\bQyKTZEQl[1].js
    Filesize

    33KB

    MD5

    285520bc859a840449187cc43864a1cb

    SHA1

    3d85ac9801d3cc9a3577bc6f6ef3c754d2677dff

    SHA256

    ac8e37a73437f2c13789726ea053c21fcdfd485896aabd6498702064968e34da

    SHA512

    7d99e9b95ed4fdc8a510b3830e7948be99d55edfac91ec71c4c7e534176a25ebe48c1955dc39a950f1a3322ef7d18910048c16492ebb9ff54d517a294602d6a5

    Download Submit

  • C:\program files (x86)\adobe\acrotray .exe
    Filesize

    133KB

    MD5

    cf582f9546624da678bb029354679296

    SHA1

    bcc4d4d039e9cd329d02981148762b612c0b58ff

    SHA256

    e87c532e7905853b1b504f4033938355aad53003652228f047aaffc5e4836ffb

    SHA512

    25f7c96f45b9d847ea5d0aaeaef3b11e469ab97f5ee9afa9d9e308aba1c7496729f9642736fe822648990bbea45133a87d9acde87c5169f9360d628909f84ec9

    Download Submit

  • memory/3644-0-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

    Download