Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30-03-2024 00:02

General

  • Target

    2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe

  • Size

    14KB

  • MD5

    2ee921b3054e3ca19ef6bc2b0a1f52a1

  • SHA1

    5034c1198a0b929dbaef92fe0044513d6ad953e6

  • SHA256

    915d419715eef666c30a7aa6f1530f90e755b66ca4ae0f95c3ced979ecff0b7d

  • SHA512

    120238fa3cde2d7cd64b876bec3770b5e65fa65951ae6bbe956280cd1a156182b945bb02f4a029ce4a51443a0a7a1a707a8c127be10cd9213f2ce4f31b9fcb47

  • SSDEEP

    384:6K+dKfzQHxFxRmyja4QhiP7UlY/pjK7aylryylFyylYLlmylylyy9lmplyEJy:v+dAURFxna4QAPQlYg7aylryylFyylYG

Score
10/10

Malware Config

Signatures

  • Upatre

    Upatre is a generic malware downloader.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2ee921b3054e3ca19ef6bc2b0a1f52a1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\szgfw.exe
      "C:\Users\Admin\AppData\Local\Temp\szgfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\szgfw.exe
    Filesize

    14KB

    MD5

    237a1deea3d93b5606bdd0d575a89e81

    SHA1

    d5b075b4289e1c8d74dfd1b91b2a65ec4502dc14

    SHA256

    624147efd6bd177b64d43c535c9020ef5fe7a5820503b073331261ad883d684e

    SHA512

    d80ca776fc99812cc55f70f5d30d08c2651a676182022013239a7d3c7521d710045c0c2bdfea4ed31715b692162e627eb2b45a5938bbbef16cf2c047d2327960