Overview

overview

7

Static

static

5

53c8c9c149...18.exe

windows7-x64

7

53c8c9c149...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 21:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    53c8c9c149bf5a94b325b403dc7f68b0_JaffaCakes118.exe

  • Size

    23KB

  • MD5

    53c8c9c149bf5a94b325b403dc7f68b0

  • SHA1

    1725858316513812b0f6b7bd40e518f00f48e7d0

  • SHA256

    0eb5a1844d58122ef353e9f20822b9fddce18c926e56431c7d2347c9ab5e539e

  • SHA512

    371e64b73cd6ac5dcc5c6d49a88630e52d244d01db8ca97d9401101673bedcfb313f851aee2c63a9511f47e492a1b15188d4ea91bcfab880a91ae37081cf3ba2

  • SSDEEP

    384:yABIpSbJUnrS0mvxC5uxxPM2iW3G3XQsyHSSWzm8Fw9OvWTr:1BTJC4xxPrbG3XhyHccX

Score
7/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53c8c9c149bf5a94b325b403dc7f68b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\53c8c9c149bf5a94b325b403dc7f68b0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\53C8C9~1.EXE >> NUL
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2420

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\08223B03.dll
          Filesize

          14KB

          MD5

          360a3ac61523ec5836b56dabf0dc9bcb

          SHA1

          79d68cb2088dbd6b54d7039ca6d5b2d2c1b27632

          SHA256

          ea2749f6f75476a4cfb73d9eb7f5a5070396baa0159b1df28e1872d1263a2aa7

          SHA512

          6ceb436a13b8c37e19a030e52ee66d3a7d83ac0db14d5532a78bff8fe55ec234242831e85a98a92c83f400636577b187482f9abcd7e70e8041d49cb4ff96d843

          Download Submit

        • memory/2244-0-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2244-6-0x0000000010000000-0x000000001000E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/2244-9-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2244-10-0x0000000010000000-0x000000001000E000-memory.dmp

          Filesize

          56KB

          Download