Overview

overview

7

Static

static

5

53c8c9c149...18.exe

windows7-x64

7

53c8c9c149...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-10-2024 21:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    53c8c9c149bf5a94b325b403dc7f68b0_JaffaCakes118.exe

  • Size

    23KB

  • MD5

    53c8c9c149bf5a94b325b403dc7f68b0

  • SHA1

    1725858316513812b0f6b7bd40e518f00f48e7d0

  • SHA256

    0eb5a1844d58122ef353e9f20822b9fddce18c926e56431c7d2347c9ab5e539e

  • SHA512

    371e64b73cd6ac5dcc5c6d49a88630e52d244d01db8ca97d9401101673bedcfb313f851aee2c63a9511f47e492a1b15188d4ea91bcfab880a91ae37081cf3ba2

  • SSDEEP

    384:yABIpSbJUnrS0mvxC5uxxPM2iW3G3XQsyHSSWzm8Fw9OvWTr:1BTJC4xxPrbG3XhyHccX

Score
7/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53c8c9c149bf5a94b325b403dc7f68b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\53c8c9c149bf5a94b325b403dc7f68b0_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\53C8C9~1.EXE >> NUL
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\08223B03.dll
    Filesize

    14KB

    MD5

    360a3ac61523ec5836b56dabf0dc9bcb

    SHA1

    79d68cb2088dbd6b54d7039ca6d5b2d2c1b27632

    SHA256

    ea2749f6f75476a4cfb73d9eb7f5a5070396baa0159b1df28e1872d1263a2aa7

    SHA512

    6ceb436a13b8c37e19a030e52ee66d3a7d83ac0db14d5532a78bff8fe55ec234242831e85a98a92c83f400636577b187482f9abcd7e70e8041d49cb4ff96d843

    Download Submit

  • memory/2980-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2980-7-0x0000000010000000-0x000000001000E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2980-11-0x0000000010000000-0x000000001000E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2980-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download