Analysis
- max time kernel
149s - max time network
122s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
11/04/2024, 16:01
General
- Target edcef6752ea8b0016d9b463b121439d2_JaffaCakes118.exe
- Size 2.7MB
- Sample240411-tgeywsac2x
- SHA256 fe642e2bc6f3aa679c5fe8720742938f3e9a89281d59cfddc0952979ae6e935b
Malware Config
Signatures
- Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edcef6752ea8b0016d9b463b121439d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\edcef6752ea8b0016d9b463b121439d2_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ponto.DLL
memory/2088-0-0x0000000000290000-0x0000000000291000-memory.dmp
memory/2088-1-0x0000000002D60000-0x0000000002E42000-memory.dmp
memory/2088-2-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-11-0x0000000006040000-0x0000000006041000-memory.dmp
memory/2088-22-0x00000000060B0000-0x00000000060B1000-memory.dmp
memory/2088-24-0x0000000006070000-0x0000000006071000-memory.dmp
memory/2088-23-0x0000000005F50000-0x0000000005F51000-memory.dmp
memory/2088-21-0x0000000005F90000-0x0000000005F91000-memory.dmp
memory/2088-20-0x0000000005FB0000-0x0000000005FB1000-memory.dmp
memory/2088-19-0x0000000006010000-0x0000000006011000-memory.dmp
memory/2088-25-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
memory/2088-18-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/2088-17-0x0000000006090000-0x0000000006091000-memory.dmp
memory/2088-16-0x0000000006290000-0x0000000006292000-memory.dmp
memory/2088-15-0x0000000006050000-0x0000000006051000-memory.dmp
memory/2088-14-0x0000000005F70000-0x0000000005F71000-memory.dmp
memory/2088-13-0x0000000006080000-0x0000000006081000-memory.dmp
memory/2088-12-0x0000000006000000-0x0000000006001000-memory.dmp
memory/2088-10-0x0000000005F80000-0x0000000005F81000-memory.dmp
memory/2088-9-0x0000000005FF0000-0x0000000005FF1000-memory.dmp
memory/2088-8-0x0000000005FC0000-0x0000000005FC1000-memory.dmp
memory/2088-7-0x0000000001610000-0x0000000001611000-memory.dmp
memory/2088-6-0x0000000001620000-0x0000000001621000-memory.dmp
memory/2088-5-0x0000000005F00000-0x0000000005F02000-memory.dmp
memory/2088-4-0x0000000005F30000-0x0000000005F31000-memory.dmp
memory/2088-3-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2088-26-0x0000000008270000-0x0000000008271000-memory.dmp
memory/2088-27-0x0000000005F60000-0x0000000005F61000-memory.dmp
memory/2088-28-0x0000000006060000-0x0000000006061000-memory.dmp
memory/2088-30-0x0000000006020000-0x0000000006021000-memory.dmp
memory/2088-31-0x0000000005F10000-0x0000000005F11000-memory.dmp
memory/2088-33-0x0000000005F20000-0x0000000005F21000-memory.dmp
memory/2088-42-0x0000000000290000-0x0000000000291000-memory.dmp
memory/2088-43-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-46-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-47-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/2088-53-0x0000000008270000-0x0000000008271000-memory.dmp
memory/2088-58-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-68-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-81-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-91-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-103-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-113-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-125-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-136-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-146-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-156-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-169-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-179-0x0000000000400000-0x0000000001544000-memory.dmp
memory/2088-189-0x0000000000400000-0x0000000001544000-memory.dmp