Overview

overview

7

Static

static

3

56f0e1a433...18.exe

windows7-x64

7

56f0e1a433...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56f0e1a4331e8a939b7c582db2ac5c4a_JaffaCakes118.exe

  • Size

    418KB

  • MD5

    56f0e1a4331e8a939b7c582db2ac5c4a

  • SHA1

    4e117150a0e27afa7a0ec035a5ea5c3d83463324

  • SHA256

    9d29952742354b82cb32d8b8fd3ce6e8cc734cd1c26c7ca5bc3bdc4e94c6d7c7

  • SHA512

    68b38f7e56fa0fa823ab62bf99ccd0f3c39461459115bb74414bc555fabf872e32757b08dec9e83059f129e8bc28ce33902c683982162a443183973415575ec7

  • SSDEEP

    6144:K1LDhBEUQ2G7E+udcoPv5n68ucAIRRNSoNbh9tjyqhDzyBkfTT9MQrFbF4mp:K1fhtQYh6VcASRNSUt9QifTT2QrP4

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56f0e1a4331e8a939b7c582db2ac5c4a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\56f0e1a4331e8a939b7c582db2ac5c4a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\ProgramData\gGb21500oOkMi21500\gGb21500oOkMi21500.exe
      "C:\ProgramData\gGb21500oOkMi21500\gGb21500oOkMi21500.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\ProgramData\gGb21500oOkMi21500\gGb21500oOkMi21500.exe
      "C:\ProgramData\gGb21500oOkMi21500\gGb21500oOkMi21500.exe" "C:\Users\Admin\AppData\Local\Temp\56f0e1a4331e8a939b7c582db2ac5c4a_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\gGb21500oOkMi21500\gGb21500oOkMi21500
    Filesize

    192B

    MD5

    276276238f911cc24836f01eee69d38b

    SHA1

    46c02c3ba5ec4e1b2df3b374c530f160ee79af45

    SHA256

    c5d411a071eebcd6a8524bef2176b12c0f9e74803e19c521576f394d0e14fd55

    SHA512

    cd8e0496323d80f634c293cc6e1c30fac4c1055b6257e83a67e57b600a1195ece66ce55b2f5517d81a6b55def25a52cb2247031696eee39dd84ceda897a36a9c

    Download Submit

  • C:\ProgramData\gGb21500oOkMi21500\gGb21500oOkMi21500.exe
    Filesize

    418KB

    MD5

    65e168bdea69eeb8be013df52b3970fa

    SHA1

    899c17899d62cca858c8fff19c2bc8f7b8f81cb7

    SHA256

    77ad54effb33a26d3e711c063fa674868e9e0c0ef9a6c440c476a07f10981601

    SHA512

    4b798c7a0f4154d6c32aba0fb6758c48b827c91c6f53fc749d88d6cd1750725186af541c7967b3caaeebb7dbfe3655ceb30e277ae547790b78419d287586a02a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\56f0e1a4331e8a939b7c582db2ac5c4a_JaffaCakes118
    Filesize

    192B

    MD5

    5df3e45d8fea3be0631fd45f01dcb9f8

    SHA1

    77d87fcd655c877fab75014f9fcd7e9a84ce4914

    SHA256

    9620241f9410a627f554e0225d65a9ab6dd46ef3256a3a1d14920e7e87505201

    SHA512

    2e3c4e9f46fd58edcf10ea3e7290a8e28f13fdd84337a9fd35de27d4979bf780da945229415bb95bf0d29138267972a61f8bae362a009d89ec0189cc70f3e775

    Download Submit

  • memory/636-0-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/636-1-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/636-21-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2572-24-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2572-31-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2572-38-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2628-16-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/2628-20-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download