Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 17:34

General

  • Target

    be76907382f73b8f9e962af193c82d53_JaffaCakes118.exe

  • Size

    484KB

  • MD5

    be76907382f73b8f9e962af193c82d53

  • SHA1

    cf3c5a90877525faf8b5caf3c4808d75aa4ffdba

  • SHA256

    c1ccafacd91f7483969270d48c71146359830cb1079e0b221b139b8fa2e997bf

  • SHA512

    06911f11465f8644320a1f308a8991c1316318725af47de8d642d47ae6fc08417b64f4c5e3d98d453a062af645fe4d9d9da64ecea64adb5c3762286ae14cd744

  • SSDEEP

    12288:E2JylsKTUHyjndvQSrrXvbGIqBGr1m+upBy:E2JyxgHyLJ5qMr1nyBy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.tmp
      C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.tmp
      2⤵
      • Executes dropped EXE
      PID:4472
    • C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.mm
      C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.mm /zhj
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SOS.exe
        C:\Windows\SOS.exe /zhj
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:4716

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.mm

          Filesize

          471KB

          MD5

          1035ad53e28e46d2242043dc6eda251b

          SHA1

          d76feb0a3afcaa8b7f5ad27cf9cd661037b52869

          SHA256

          6890bc0e599ff54dd18cdbc9980b86dd20312d25452fabe0f2d808080bf549d1

          SHA512

          636f95339bd43fd5ffaa240e50679cc48e38784c807a03bad905c297cffe05f0abea633b21d9889fed3b4f9e2b244df58d38d1e7f618e9911e28961a91559498

        • C:\Users\Admin\AppData\Local\Temp\be76907382f73b8f9e962af193c82d53_JaffaCakes118.tmp

          Filesize

          13KB

          MD5

          5929f882ea0c71123fc41de8e26949d1

          SHA1

          a3b2529823741beabef45301f3f50a9347438ac6

          SHA256

          244fd7e7e9ed1f6fb5090c7f7a062272c9feb507281d1b8fe54650db5ec7796b

          SHA512

          387259fc4c41b52be5eb426d3d26333faf3644d376e485cdad1222c4bbcdcd8596f2fd78d51dad4d0ee0d67dc374b1542017cc77ac1d8659923df0c5b0013cf0

        • memory/2032-14-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/2916-65-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-74-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-80-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-70-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-72-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-66-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-76-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-78-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-68-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-82-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-84-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-86-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-88-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-90-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4716-92-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB