Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 05:11

General

  • Target

    dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    dc13d24e056c80813c44d68d54af8cfd

  • SHA1

    a9f34ebe418d9efcb517f077cc2f965e2d6c9a34

  • SHA256

    7b014711b716b2b4258214c6a4e2a2643d29403371dbcd717bd042d391299d7d

  • SHA512

    3da4f732958683ccd96f24545e2c18ef72e6db3e36c1e8e8289c72cada165a7fab93cabf5989730478725a95f42f99a146299dbaeb488a441e4cc5ee6b89a30e

  • SSDEEP

    1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitiF4GQadCh:qKtfDwsjPThTYszDH2fDGhu

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1368
      • C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2664
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\$$a4C7B.bat
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1692
          • C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"
            4⤵
            • Executes dropped EXE
            PID:2800
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2780

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\$$a4C7B.bat

            Filesize

            614B

            MD5

            8d1b5144280099263f4992649a8dd2fa

            SHA1

            67507d7af94e029746a15815d4fe3b2b3bdf07bf

            SHA256

            c19a88e5cb48f25127a10d7fe223f9beaba761fb05be5ad8472ba3b07f97c5ce

            SHA512

            8177a495b83f5853694461e35fd3331252d9a7edd4ef8363a2d5622f99f4e6eaec950166c91491a4b93b5846777ebef53cba9eeb7819c486c34ebec33f0998c5

          • C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe.exe

            Filesize

            14KB

            MD5

            bde3ac1c9b09fc1b55c6e398009a9c83

            SHA1

            fa99711be9d0812383d1f41e9277bd3ba71eb09f

            SHA256

            059263f4b3635da33f1bae9789b13f287bce7b8dedc960201e8807e6de9b3fc5

            SHA512

            af2ff4728885c6319800f98f4f639f836eb4713272d3dbf38c5f473b91b398747ce6bdc56d32cd0fc2ddc88f3ba1b99e170e6f679341d4c3e5a9eafaf3930e99

          • C:\Windows\Logo1_.exe

            Filesize

            58KB

            MD5

            a7dcffd56f068633bfaf85ec3d65d08b

            SHA1

            36cba2a5522ebd673107d63f9d8e1afbdfa236b6

            SHA256

            409f7415b7b10f6d801014ac6b0e3cea785ad5a73ba397f46765bbd3dcf36367

            SHA512

            78dc44535430d92307bfbd5b679159f7032306f3f818b0d5a3264347c227bd8edd0ae07bd9f6beaf91c33ee81a451d01177d08c254ace779dfd66ab9666bf6d1

          • memory/1368-19-0x00000000026F0000-0x00000000026F1000-memory.dmp

            Filesize

            4KB

          • memory/2664-14-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

          • memory/2780-240-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB