Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 17:10

General

  • Target

    f19008d768186f383e4689279af615e6_JaffaCakes118.exe

  • Size

    55KB

  • MD5

    f19008d768186f383e4689279af615e6

  • SHA1

    3e4d8ab42ba1c7da22e24ae082d609b9de384495

  • SHA256

    401b2c3651b6f7aded8c3a691c7852aeae6a18798dafc0d727e93aff776ac52f

  • SHA512

    b7c2614b8a8ab6e4258da1caef266b4af34833914611446693af75c369e07141d216276b3f844104864b1fffa65a1f1efeb9950e4fd1f7da413358759a1ab625

  • SSDEEP

    1536:4N0p091w2dDmVLK9MXIHySUxcZ1FLCqdu:4Q092YDwLK9MYHySUxcDVu

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f19008d768186f383e4689279af615e6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f19008d768186f383e4689279af615e6_JaffaCakes118.exe"
    1⤵
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s mstrans.dll
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:848
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F19008~1.EXE >> NUL
      2⤵
      • Deletes itself
      PID:1628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\mstrans.dll

    Filesize

    44KB

    MD5

    fb27d1cac152992654ae662e34f5b350

    SHA1

    4af2613c8772adf849bc099cf7e931f378a48d37

    SHA256

    a541d24d0c3713d22a21b2310ebf170929f10371a4528fd5ab1181f7f622aab2

    SHA512

    ace64a4efe00ef589ccfbb8c83a2d3fbb3c9e55665c98195f523e8ec54e59d0f1a4576603c4fe6b8d2d0491b8b5ce45f3c69d254f6912ea2c56fd85a8d789c1f

  • memory/848-4-0x0000000020000000-0x0000000020023000-memory.dmp

    Filesize

    140KB