Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-04-2024 17:10

General

  • Target

    f19008d768186f383e4689279af615e6_JaffaCakes118.exe

  • Size

    55KB

  • MD5

    f19008d768186f383e4689279af615e6

  • SHA1

    3e4d8ab42ba1c7da22e24ae082d609b9de384495

  • SHA256

    401b2c3651b6f7aded8c3a691c7852aeae6a18798dafc0d727e93aff776ac52f

  • SHA512

    b7c2614b8a8ab6e4258da1caef266b4af34833914611446693af75c369e07141d216276b3f844104864b1fffa65a1f1efeb9950e4fd1f7da413358759a1ab625

  • SSDEEP

    1536:4N0p091w2dDmVLK9MXIHySUxcZ1FLCqdu:4Q092YDwLK9MYHySUxcDVu

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f19008d768186f383e4689279af615e6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f19008d768186f383e4689279af615e6_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s mstrans.dll
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2144
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F19008~1.EXE >> NUL
      2⤵
        PID:1936

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\mstrans.dll

      Filesize

      44KB

      MD5

      fb27d1cac152992654ae662e34f5b350

      SHA1

      4af2613c8772adf849bc099cf7e931f378a48d37

      SHA256

      a541d24d0c3713d22a21b2310ebf170929f10371a4528fd5ab1181f7f622aab2

      SHA512

      ace64a4efe00ef589ccfbb8c83a2d3fbb3c9e55665c98195f523e8ec54e59d0f1a4576603c4fe6b8d2d0491b8b5ce45f3c69d254f6912ea2c56fd85a8d789c1f

    • memory/2144-4-0x0000000020000000-0x0000000020023000-memory.dmp

      Filesize

      140KB