Analysis

  • max time kernel
    138s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 07:47

General

  • Target

    04b4cc6fcdc42e673a1471a60f26078d_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    04b4cc6fcdc42e673a1471a60f26078d

  • SHA1

    585291f439f32494122b5d249573dfe48f2e7edb

  • SHA256

    55c552d0e10dc77cdc3bf6a110c9fd056d4a934781bfee053d97e4518a6e89cc

  • SHA512

    8ee89d6da75a35eab62727dd882e21f335a889a62c4e12c667b2e744bf29d047bdfeb19fab36d8cdd45b937e194656108d9c87fe1be56e7bc373718746723609

  • SSDEEP

    12288:9pPvX3M/KwTMlgC9mYeHn+d/vULsj5XqaZ+IgdCiDPhtMJzcYLqDrDl+qxUCV/nz:/vQwUHuDca9Ws+X/xU4/tdaCZQ4

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04b4cc6fcdc42e673a1471a60f26078d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04b4cc6fcdc42e673a1471a60f26078d_JaffaCakes118.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2288

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2288-4-0x0000000000150000-0x0000000000151000-memory.dmp
    Filesize

    4KB

  • memory/2288-3-0x0000000000100000-0x0000000000101000-memory.dmp
    Filesize

    4KB

  • memory/2288-2-0x00000000000F0000-0x00000000000F1000-memory.dmp
    Filesize

    4KB

  • memory/2288-1-0x0000000000030000-0x0000000000031000-memory.dmp
    Filesize

    4KB

  • memory/2288-0-0x0000000000020000-0x0000000000021000-memory.dmp
    Filesize

    4KB

  • memory/2288-6-0x0000000000170000-0x0000000000171000-memory.dmp
    Filesize

    4KB

  • memory/2288-7-0x0000000000180000-0x0000000000181000-memory.dmp
    Filesize

    4KB

  • memory/2288-5-0x0000000000160000-0x0000000000161000-memory.dmp
    Filesize

    4KB

  • memory/2288-9-0x00000000005B0000-0x00000000005B1000-memory.dmp
    Filesize

    4KB

  • memory/2288-8-0x0000000000570000-0x0000000000571000-memory.dmp
    Filesize

    4KB

  • memory/2288-10-0x0000000002640000-0x0000000002642000-memory.dmp
    Filesize

    8KB

  • memory/2288-11-0x0000000002700000-0x0000000002702000-memory.dmp
    Filesize

    8KB

  • memory/2288-12-0x0000000002950000-0x0000000002952000-memory.dmp
    Filesize

    8KB

  • memory/2288-15-0x0000000002D80000-0x0000000002EAA000-memory.dmp
    Filesize

    1.2MB