Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 13:37

General

  • Target

    b9b275c08efd0e570023ea72b87d11ca_JaffaCakes118.exe

  • Size

    244KB

  • MD5

    b9b275c08efd0e570023ea72b87d11ca

  • SHA1

    973e50e7a08a9a043c954d01b36e81d4b9e8971b

  • SHA256

    a99d97ddfd8fe18d735e8f849a532558f3b6f71b105770d391957c160708bcbc

  • SHA512

    660f8ad67dec852a057ab59c1dc5db45645637843800365f4566d6bce579e2491720f2e13832fa589f34ab65a24b77ffa82aa837606891419626ace32e32fbe8

  • SSDEEP

    6144:ZqobsBIUj9y0NPe9DMm0biMLEJOY0+sSNmHP:ZlYBIUj9yZ9DMfiva+sx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3488
    • C:\Users\Admin\AppData\Local\Temp\b9b275c08efd0e570023ea72b87d11ca_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b9b275c08efd0e570023ea72b87d11ca_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Users\Admin\AppData\Roaming\MRINubst\Gamedctr.exe
        "C:\Users\Admin\AppData\Roaming\MRINubst"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Local\Temp\~6A81.tmp
          3488 250376 1480 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 624
        3⤵
        • Program crash
        PID:1420
  • C:\Windows\SysWOW64\prevmote.exe
    C:\Windows\SysWOW64\prevmote.exe -s
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:3392
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4412 -ip 4412
    1⤵
      PID:3708

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\~6A81.tmp

            Filesize

            8KB

            MD5

            aac3165ece2959f39ff98334618d10d9

            SHA1

            020a191bfdc70c1fbd3bf74cd7479258bd197f51

            SHA256

            96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

            SHA512

            9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

          • C:\Users\Admin\AppData\Roaming\MRINubst\Gamedctr.exe

            Filesize

            244KB

            MD5

            b4415dfb23ca836e2d9644a08cea259e

            SHA1

            f0d85f83dc734667bdc40979f04084c6f60cc5d8

            SHA256

            fce8614e61613b6042d72af9540a52ad6e9ee35caa997f046fd46a997960e720

            SHA512

            20b575063a33c854a7e4c59c6b9d3e5b7c1f2fadffbb596af513bb0a34d3e28d44b21c0bbfd80d2252ce696bc2c7778fae53300b6cca4424d8cf195cac194a12

          • memory/1480-13-0x00000000001C0000-0x00000000001C6000-memory.dmp

            Filesize

            24KB

          • memory/1480-7-0x00000000000D0000-0x0000000000117000-memory.dmp

            Filesize

            284KB

          • memory/3392-18-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/3392-15-0x0000000000920000-0x0000000000926000-memory.dmp

            Filesize

            24KB

          • memory/3392-21-0x00000000000D0000-0x0000000000117000-memory.dmp

            Filesize

            284KB

          • memory/3392-17-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/3392-26-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/3488-22-0x0000000008360000-0x000000000836D000-memory.dmp

            Filesize

            52KB

          • memory/3488-20-0x0000000008350000-0x0000000008356000-memory.dmp

            Filesize

            24KB

          • memory/3488-14-0x0000000004CF0000-0x0000000004D3D000-memory.dmp

            Filesize

            308KB

          • memory/3488-16-0x0000000004CF0000-0x0000000004D3D000-memory.dmp

            Filesize

            308KB

          • memory/4412-0-0x00000000000D0000-0x0000000000117000-memory.dmp

            Filesize

            284KB

          • memory/4412-25-0x00000000000D0000-0x0000000000117000-memory.dmp

            Filesize

            284KB