Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26/04/2024, 16:40

General

  • Target

    01340048af59a7ac31b10934920698b2_JaffaCakes118.exe

  • Size

    2.1MB

  • MD5

    01340048af59a7ac31b10934920698b2

  • SHA1

    8c205adc18cca457bacc57592b91d6e7bcb792e1

  • SHA256

    5890aec86a1f5e8ebd5e54fb2d1137c9a42f49eaa2893fc8f3ac45030e2366f0

  • SHA512

    0be0fcbecbf21e6925d1edd95cabeef1aad0d37ec18ef53b89322bb637ee3fae5d882b93c0c96d9cc9fca9a3c65bf5b81b50948d0abed6744182c668725fcbc8

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwN

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2040
      • C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\01340048af59a7ac31b10934920698b2_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:2640

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\Parameters.ini

            Filesize

            74B

            MD5

            6687785d6a31cdf9a5f80acb3abc459b

            SHA1

            1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

            SHA256

            3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

            SHA512

            5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

          • memory/2640-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2640-20-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2640-24-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2640-27-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2640-33-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2844-0-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2844-17-0x0000000000400000-0x00000000005D3000-memory.dmp

            Filesize

            1.8MB

          • memory/2844-19-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2844-28-0x0000000000400000-0x00000000005D3000-memory.dmp

            Filesize

            1.8MB