Overview

overview

10

Static

static

3

9292c01026...18.exe

windows7-x64

7

9292c01026...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2024, 04:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9292c01026392c900b72e4bc543ee4d1_JaffaCakes118.exe

  • Size

    84KB

  • MD5

    9292c01026392c900b72e4bc543ee4d1

  • SHA1

    76563158b9f884fad61632e8eb30b7063de4b467

  • SHA256

    d88d7e3bdaad0b97a1e7e139b464a5464ee28d5b70ebb055a4f5e12b18c6342c

  • SHA512

    bfe9047ae353f3f9696209897ab1b5d34d5faa1117cd50bddd144773fc13edd487add63a8f2d8c825fa2c0e846c8a4ff4c9616c6847d64b7cf978031966e0d5e

  • SSDEEP

    1536:N08QMDAozYeVWnJOz2Swc/KbCi7RTuEEfhxwzi3rIEzdnjuhbh:lDxWnJOz1GbCaTuEehxwzUrI6dnjuhbh

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9292c01026392c900b72e4bc543ee4d1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9292c01026392c900b72e4bc543ee4d1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\9292c01026392c900b72e4bc543ee4d1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\9292c01026392c900b72e4bc543ee4d1_JaffaCakes118.exe
      2⤵
        PID:2156
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CertPolEng.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CertPolEng.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Users\Admin\AppData\Local\Temp\panmap.exe
          C:\Users\Admin\AppData\Local\Temp\\panmap.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2956
          • C:\Users\Admin\AppData\Local\Temp\panmap.exe
            C:\Users\Admin\AppData\Local\Temp\panmap.exe
            4⤵
              PID:2324

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\panmap.exe
        Filesize

        84KB

        MD5

        9292c01026392c900b72e4bc543ee4d1

        SHA1

        76563158b9f884fad61632e8eb30b7063de4b467

        SHA256

        d88d7e3bdaad0b97a1e7e139b464a5464ee28d5b70ebb055a4f5e12b18c6342c

        SHA512

        bfe9047ae353f3f9696209897ab1b5d34d5faa1117cd50bddd144773fc13edd487add63a8f2d8c825fa2c0e846c8a4ff4c9616c6847d64b7cf978031966e0d5e

        Download Submit

      • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CertPolEng.exe
        Filesize

        6KB

        MD5

        09050857004e30fc1235827a82aa849c

        SHA1

        8b656860644de40992999db81e48078882dbe3d9

        SHA256

        2bcea9ed1bcafdd3796cecf86ff868539ee278eb257c20617440aac9fa5eada9

        SHA512

        48221e78007ce8f5a423898fec15651cc1af309aac28a9140bfcf69d1de2051e77a77c39267c425e4bb7f33d8fe8e46b27e37f081f373c25c4967e0467006f9f

        Download Submit

      • memory/2116-0-0x0000000074F01000-0x0000000074F02000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2116-1-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2116-2-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2116-19-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2116-20-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2420-15-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2420-17-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2420-21-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2420-22-0x0000000074F00000-0x00000000754AB000-memory.dmp

        Filesize

        5.7MB

        Download