Overview

overview

10

Static

static

3

75b22a8d8c...18.exe

windows7-x64

10

75b22a8d8c...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-10-2024 01:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75b22a8d8c9506770d8057d0d83f671e_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    75b22a8d8c9506770d8057d0d83f671e

  • SHA1

    0900300539c9010d6fea83227af3011ee235d75f

  • SHA256

    b7f10c8e266aca99a9ceb638b223baa01b0e1f648373d72f6abd0a6b5a994fee

  • SHA512

    21cc89df746f48214eb979670222aef168c84bd2543ecde401ad4695278db07617676db4c07d6669bc8a70eb65c769777e964ab915a638cceae4bc69a4057e65

  • SSDEEP

    49152:5dOjNXMu8VaWg/IbwsYRxUGXET3pbjX6JyytOdsi3:3OjtMaWZUxUfT35X06si

Score
8/10
discoverypersistenceupx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75b22a8d8c9506770d8057d0d83f671e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\75b22a8d8c9506770d8057d0d83f671e_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\SysWOW64\Cloud AV 2012v121.exe
      C:\Windows\system32\Cloud AV 2012v121.exe 5985C:\Users\Admin\AppData\Local\Temp\75b22a8d8c9506770d8057d0d83f671e_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Users\Admin\AppData\Roaming\egTZqjYCeIrOyA\Cloud AV 2012v121.exe
        C:\Users\Admin\AppData\Roaming\egTZqjYCeIrOyA\Cloud AV 2012v121.exe 5985C:\Windows\SysWOW64\Cloud AV 2012v121.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1752
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\ahst.lni
    Filesize

    608B

    MD5

    0ca0f372d618fff73c11f7c9dc90cf48

    SHA1

    491d1f327d173350361469fea6f8159a67450bb5

    SHA256

    a85098d18272cf0425d6564db9a4ab37a24964de2fdb06852ac81ec0f472bf68

    SHA512

    469e3996d4feed39de43d8f022a8a6ee871ce609409a6680afe05045bd2650b902143e78ee5a4bb71ec265bea938bf3e8660173f1a6f15c61f8cf4722cdaa91a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ahst.lni
    Filesize

    1KB

    MD5

    e69ca639f8e7c4609f2b5dc994ce289e

    SHA1

    b9968bf6970ae0ed8be98fb50a143e66bdc66517

    SHA256

    52fa7eab8e68939965dcd074c4ad535ec5668fe730894e9e373a2b0c7e29afeb

    SHA512

    1c22cab32ff74fab705c33c97ba44fb6008ea604b82062b5c47e07381663d5e13225395684fe991aecfc95a053205f8e8e2ea94817e7f161d7566012a7b7eb81

    Download Submit

  • C:\Windows\SysWOW64\Cloud AV 2012v121.exe
    Filesize

    1.9MB

    MD5

    75b22a8d8c9506770d8057d0d83f671e

    SHA1

    0900300539c9010d6fea83227af3011ee235d75f

    SHA256

    b7f10c8e266aca99a9ceb638b223baa01b0e1f648373d72f6abd0a6b5a994fee

    SHA512

    21cc89df746f48214eb979670222aef168c84bd2543ecde401ad4695278db07617676db4c07d6669bc8a70eb65c769777e964ab915a638cceae4bc69a4057e65

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    88059ae1e846d058a259714b0abcca4e

    SHA1

    3b3a5ac74228d6a48d52b92896262a78ea706896

    SHA256

    a535511541bf82de1ee0004e03485c39fc689d56cda3cbc7164557c155525ddd

    SHA512

    0c480f1ea2b0d73523fbc58becb78052d9b89735a889afabd9eac559fa7d70517c12fb6dfe8a947d9a1e7c58780a41be7a7001082c5168a2800c263c6c620cbf

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    5b8ca13f53960a93f94b08fd9f202e18

    SHA1

    00bd9fc9b1ac0f88bbf90d0026d394771bb39aa6

    SHA256

    541a690d5fc104d3ffe59e400627789d49a481070815f403074b1e205ffa7ec3

    SHA512

    6d738543b489be0cbebca00cd672d48ac83c7c297c4721cba79cac923d9ef43b32c7847b29d79fa8dccd9c5d5501615f494fc8e208d4186e8eeed476553a6e8e

    Download Submit

  • C:\Windows\System32\drivers\etc\hosts
    Filesize

    1KB

    MD5

    50ab0dd716dd66ad0c3eb5fb63f2f118

    SHA1

    bd9641078264b2135d3b3b0007c98f977d057960

    SHA256

    1f9037b078250201c92f8e1ea1ad3023011039c76a5aa74d3710edc452fc6517

    SHA512

    24c0b8ca8650fb50f81b9a89bbb7e8e5492b303b065fbf846c55aeb76c9fc41ebb5b9c6163d168a1362941720473486fdf2596dab4764176ebb348ad264b61d6

    Download Submit

  • memory/1752-110-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1752-142-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1752-231-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1752-88-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1752-198-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1752-99-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1752-153-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1752-131-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1848-12-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1848-11-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1848-18-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2852-8-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2852-1-0x0000000000400000-0x0000000000914000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2852-2-0x0000000000400000-0x0000000000917000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2852-9-0x0000000000400000-0x0000000000914000-memory.dmp

    Filesize

    5.1MB

    Download