Analysis

  • max time kernel
    126s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 14:45

General

  • Target

    f14ec6f72419e2bf8ebc721bb2e79bf0_JaffaCakes118.exe

  • Size

    722KB

  • MD5

    f14ec6f72419e2bf8ebc721bb2e79bf0

  • SHA1

    80c534e25a7a48dfa666aad6648ca22a90d4ca00

  • SHA256

    ad6e55414d2c5e811c1c7d5cd193820a5616e2b858992c9cbc246f8f7e1ee1a9

  • SHA512

    104d1c68932e27ac5dab23bc8b83de4386f0b19793691b6fab64f11f48b191be39edec58bcb2d069075c05249159c8c7997549621cb0a1d6b3396c83dc4fa146

  • SSDEEP

    12288:n9FL0w8RtsoatrRnyIEENLXZNDrGofoFDqF3Z4mxxNqqEeT3GH73a:n8w83sPDtEYLXjfoFWQmXwpeTora

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f14ec6f72419e2bf8ebc721bb2e79bf0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f14ec6f72419e2bf8ebc721bb2e79bf0_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3820
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4436
  • C:\Windows\QQ.exe
    C:\Windows\QQ.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2368

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\QQ.exe

            Filesize

            788KB

            MD5

            7cc1965db778e7a4f52dbac37a25b5de

            SHA1

            f5206b6ba4a0a0c85fa1b0c3a90245a4633d1cef

            SHA256

            94d4366eaeb86b0a83d2639049334181ad97694df71cb8fa470189536b3ca163

            SHA512

            fd0ea2a63d310955c766f4bb941fa2d091b3e03212d5f73a1a0b82734e2a7491472b378e8b05e1cf20574c649abc41823c9be43a64bd74682f61b7a887b8015d

          • memory/3820-60-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-68-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-70-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-5-0x0000000000B40000-0x0000000000B41000-memory.dmp

            Filesize

            4KB

          • memory/3820-4-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

            Filesize

            4KB

          • memory/3820-7-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

            Filesize

            4KB

          • memory/3820-6-0x00000000006A0000-0x00000000006A1000-memory.dmp

            Filesize

            4KB

          • memory/3820-8-0x0000000000B90000-0x0000000000B91000-memory.dmp

            Filesize

            4KB

          • memory/3820-9-0x0000000003130000-0x0000000003131000-memory.dmp

            Filesize

            4KB

          • memory/3820-11-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

            Filesize

            4KB

          • memory/3820-13-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-14-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-12-0x0000000003130000-0x0000000003131000-memory.dmp

            Filesize

            4KB

          • memory/3820-15-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-10-0x0000000003130000-0x0000000003131000-memory.dmp

            Filesize

            4KB

          • memory/3820-17-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-16-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-18-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-21-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-22-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-24-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-26-0x0000000000C10000-0x0000000000C11000-memory.dmp

            Filesize

            4KB

          • memory/3820-32-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

            Filesize

            4KB

          • memory/3820-34-0x0000000000C50000-0x0000000000C51000-memory.dmp

            Filesize

            4KB

          • memory/3820-33-0x0000000000C60000-0x0000000000C61000-memory.dmp

            Filesize

            4KB

          • memory/3820-35-0x0000000000C80000-0x0000000000C81000-memory.dmp

            Filesize

            4KB

          • memory/3820-55-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-54-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-53-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-52-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-0-0x0000000001000000-0x0000000001125000-memory.dmp

            Filesize

            1.1MB

          • memory/3820-1-0x0000000000530000-0x0000000000584000-memory.dmp

            Filesize

            336KB

          • memory/3820-3-0x0000000000B60000-0x0000000000B61000-memory.dmp

            Filesize

            4KB

          • memory/3820-2-0x0000000000B80000-0x0000000000B81000-memory.dmp

            Filesize

            4KB

          • memory/3820-61-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-67-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-66-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-65-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-64-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-63-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-62-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-69-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-57-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-56-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-51-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-50-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-49-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-48-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-47-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-46-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-45-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-44-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-43-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-42-0x0000000000D00000-0x0000000000D01000-memory.dmp

            Filesize

            4KB

          • memory/3820-41-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

            Filesize

            4KB

          • memory/3820-40-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

            Filesize

            4KB

          • memory/3820-39-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

            Filesize

            4KB

          • memory/3820-38-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

            Filesize

            4KB

          • memory/3820-37-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-36-0x0000000000C00000-0x0000000000C01000-memory.dmp

            Filesize

            4KB

          • memory/3820-31-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

            Filesize

            4KB

          • memory/3820-28-0x0000000000C70000-0x0000000000C71000-memory.dmp

            Filesize

            4KB

          • memory/3820-25-0x0000000000C40000-0x0000000000C41000-memory.dmp

            Filesize

            4KB

          • memory/3820-23-0x0000000003120000-0x000000000313B000-memory.dmp

            Filesize

            108KB

          • memory/3820-95-0x0000000001000000-0x0000000001125000-memory.dmp

            Filesize

            1.1MB

          • memory/4436-93-0x0000000000400000-0x00000000004CE000-memory.dmp

            Filesize

            824KB