Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/04/2024, 17:50

General

  • Target

    bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    bec83a08a91042c1b2821e5e017a7454

  • SHA1

    29f14719377327016caba6f7d660271c307db76e

  • SHA256

    8c5d1e372be183f79a1e791b42c234e7abd1b4f83616803633e60a0db12366fd

  • SHA512

    139e9817df218756ed8d1dd324f2295949ab19c0927fa3fc60825809775f9c07ce706dc696644c2459f1409d1579718e5f44b8dc45415c59b5c4c74fa3df90d0

  • SSDEEP

    768:j+MPow1owYOWJOaoEty+6YPNEOAdnupNqFNcXfLgA86W5LcbujXwbQ9eptlR3qEC:1Aw1owcVfd44rDHEmNfP8Sv+QA

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\kiroq.exe
      "C:\Users\Admin\kiroq.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2952

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\kiroq.exe

          Filesize

          72KB

          MD5

          6d082ddb44121bafd70b6c4d72b46a75

          SHA1

          3d86bd43ad14f51f7f6989d823fe10ad39d780a3

          SHA256

          47e80c3c72f3ceca42bf64828f7a63a35d3192897874d2678ddff17e9f271dfc

          SHA512

          bd374df13964fa6f70355fa94af30097a07270f3b56e8f79e3dfa0792d1eebe693ea52d534cad8238f99b47f5f8384138cdc9da3c37f3671b9b05f602db8030d