Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 02:54

General

  • Target

    fbc544386e725b2cdc8040fd736526cf_JaffaCakes118.exe

  • Size

    3.5MB

  • MD5

    fbc544386e725b2cdc8040fd736526cf

  • SHA1

    acb6d3d41c72425138dbfce50e7e304663deea43

  • SHA256

    70033a2b131c5d3ae450eee9d4e6a368f75e49951e5851189540f9c9b7fcc9e7

  • SHA512

    fd9ac10855a40fd644264ff5a273515e753296ce24ba93965bca400d2d269afc9300ee185e3a9d63a1f075f331adbc5d9d819ab460a91fd0e43ec35cc111fc28

  • SSDEEP

    98304:iB1C+q8FFwpeEk2wCOwh2YhsglD/Szqi6GlNCME:oMa1Ek2Zh2Y//86GDE

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fbc544386e725b2cdc8040fd736526cf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fbc544386e725b2cdc8040fd736526cf_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsoD09A.tmp\tools.dll

    Filesize

    236KB

    MD5

    e12f05661436f2974cf91b5fc76fb5f4

    SHA1

    5e0b7887950204713bef3da0018911279f2540ec

    SHA256

    1873de723938193f9f0877b08c160884b79503b6607598158ad99bd909189fdc

    SHA512

    61d42e055865dd98552b29dd69dc3d761bc7f77c1af108ad13b0b390059be5668657645258c0c08052a5fe1e9f6bdb018da136eb103b7335097487ec0de5d22d

  • memory/2180-19-0x0000000002440000-0x0000000002480000-memory.dmp

    Filesize

    256KB

  • memory/2180-23-0x0000000073A40000-0x0000000073FEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2180-24-0x0000000073A40000-0x0000000073FEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2180-25-0x0000000002440000-0x0000000002480000-memory.dmp

    Filesize

    256KB

  • memory/2180-26-0x0000000002440000-0x0000000002480000-memory.dmp

    Filesize

    256KB

  • memory/2180-29-0x0000000005E90000-0x0000000005F90000-memory.dmp

    Filesize

    1024KB

  • memory/2180-30-0x0000000005E90000-0x0000000005F90000-memory.dmp

    Filesize

    1024KB

  • memory/2180-31-0x0000000005E90000-0x0000000005F90000-memory.dmp

    Filesize

    1024KB

  • memory/2180-42-0x0000000073A40000-0x0000000073FEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2180-43-0x0000000002440000-0x0000000002480000-memory.dmp

    Filesize

    256KB

  • memory/2180-44-0x0000000073A40000-0x0000000073FEB000-memory.dmp

    Filesize

    5.7MB

  • memory/2180-45-0x0000000005E90000-0x0000000005F90000-memory.dmp

    Filesize

    1024KB