Analysis

  • max time kernel
    155s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/04/2024, 13:37

General

  • Target

    b9b275c08efd0e570023ea72b87d11ca_JaffaCakes118.exe

  • Size

    244KB

  • MD5

    b9b275c08efd0e570023ea72b87d11ca

  • SHA1

    973e50e7a08a9a043c954d01b36e81d4b9e8971b

  • SHA256

    a99d97ddfd8fe18d735e8f849a532558f3b6f71b105770d391957c160708bcbc

  • SHA512

    660f8ad67dec852a057ab59c1dc5db45645637843800365f4566d6bce579e2491720f2e13832fa589f34ab65a24b77ffa82aa837606891419626ace32e32fbe8

  • SSDEEP

    6144:ZqobsBIUj9y0NPe9DMm0biMLEJOY0+sSNmHP:ZlYBIUj9yZ9DMfiva+sx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\b9b275c08efd0e570023ea72b87d11ca_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b9b275c08efd0e570023ea72b87d11ca_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1416
      • C:\Users\Admin\AppData\Roaming\RMAcerpt\autoPlay.exe
        "C:\Users\Admin\AppData\Roaming\RMAcerpt"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Users\Admin\AppData\Local\Temp\~677A.tmp
          1196 250376 2396 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 252
        3⤵
        • Program crash
        PID:2572
  • C:\Windows\SysWOW64\cleaethc.exe
    C:\Windows\SysWOW64\cleaethc.exe -s
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:2612

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\~677A.tmp

          Filesize

          8KB

          MD5

          aac3165ece2959f39ff98334618d10d9

          SHA1

          020a191bfdc70c1fbd3bf74cd7479258bd197f51

          SHA256

          96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

          SHA512

          9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

        • \Users\Admin\AppData\Roaming\RMAcerpt\autoPlay.exe

          Filesize

          244KB

          MD5

          219f0b1f8afe41cd45c07cbc09a5e24e

          SHA1

          9bba33be75c3cd1268d41160979b828608d0602e

          SHA256

          8b8055bb0ed200ddeb2832e6b3bc64d54b2a61ecc6840531fa5d96a0eb7e6a75

          SHA512

          62d18ba97803d430804ed6bdb2444fbd5b5cf4fe2bea5b758c08a2cc5ca7ba64d3e60d8df18beb2b17d2d78f6a475c2ffe2c3688338066bf6777c019864f43f7

        • memory/1196-21-0x0000000002AB0000-0x0000000002AFD000-memory.dmp

          Filesize

          308KB

        • memory/1196-31-0x0000000002B60000-0x0000000002B6D000-memory.dmp

          Filesize

          52KB

        • memory/1196-27-0x0000000002B50000-0x0000000002B56000-memory.dmp

          Filesize

          24KB

        • memory/1196-19-0x0000000002AB0000-0x0000000002AFD000-memory.dmp

          Filesize

          308KB

        • memory/1196-17-0x0000000002AB0000-0x0000000002AFD000-memory.dmp

          Filesize

          308KB

        • memory/1416-0-0x0000000000320000-0x0000000000367000-memory.dmp

          Filesize

          284KB

        • memory/1416-34-0x0000000000320000-0x0000000000367000-memory.dmp

          Filesize

          284KB

        • memory/2396-14-0x00000000003B0000-0x00000000003B6000-memory.dmp

          Filesize

          24KB

        • memory/2396-13-0x00000000002D0000-0x0000000000317000-memory.dmp

          Filesize

          284KB

        • memory/2612-22-0x0000000000320000-0x0000000000367000-memory.dmp

          Filesize

          284KB

        • memory/2612-23-0x0000000000390000-0x0000000000396000-memory.dmp

          Filesize

          24KB

        • memory/2612-25-0x0000000000380000-0x0000000000386000-memory.dmp

          Filesize

          24KB

        • memory/2612-29-0x0000000000380000-0x0000000000386000-memory.dmp

          Filesize

          24KB

        • memory/2612-35-0x0000000000380000-0x0000000000386000-memory.dmp

          Filesize

          24KB