Analysis
-
max time kernel
67s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28-04-2024 16:22
General
-
Target
0597ef64bbe482a92adb1909eba8f923_JaffaCakes118.exe
-
Size
435KB
-
MD5
0597ef64bbe482a92adb1909eba8f923
-
SHA1
d874159f809c6709bbf4b820fa1f60bb006afa3d
-
SHA256
137b4ef415e3a38d4d40322fb9c9dc3a1ffb4828d38224fe5a625a84376b885e
-
SHA512
1b4478a7d9e4c8666e6f91ff676fb339a3f3c726c21e3748bc0d691dbc5c0f020598edf6d97a9a16663f54513e29527e343ecb8a36a6485db6123ef85961ba39
-
SSDEEP
12288:KKz4hAmKw0Li7et1ZeV7wAiNMh+toQZwTaFP3WNJjc9ho/:KKzRDw0L0G1ZOwAiNU+edGxIi2/
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0597ef64bbe482a92adb1909eba8f923_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0597ef64bbe482a92adb1909eba8f923_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 7403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3040 -ip 30401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD590a07b4d2b96d88a55158acc9a67c905
SHA1c019fb8595572c96b698779e2f7ff686688f8c70
SHA256f93d0d8b468081aa693149e54a67b2a399d93e2f135fc6f65c78090c52bb31b7
SHA5121b726c782aeb31142bc7eed191803e671e6d65d49928b8427bacdddba1368bf68cb4b35722b8473fbb003c5461b5960566f859a970c0bedc625145bbdb760b45
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
152KB
MD512cd42bf61fe63acec4a2c452b8f4e5a
SHA1b99d152d45091969d38c47ef1b4167ed22dd99b2
SHA256d733973641dc967a4fce5ed2a82a427c66ee70106cff38be260f3001b5386ab8
SHA512b26e76979fdccd8e8bc2f37dcac2de57bed543ec919f8ef6e2be433aa24bad38d86dece7ae31d185ab19509df3c0ebd3e5a36d88e5f5d3e033986fe9fa813cfa
-
Filesize
151KB
MD5d7f903ac9ea7a0b33b6b0a8340f0d508
SHA144bf0aa7745845c9d3ec6a1ad88edb0b90dd25f5
SHA25679842dafee993856a7b63daa308400b46e352446bc14cba0f105d1d3ef7ecc1f
SHA512d1f712f0e26e336a3587859bcc0f31b45057e3679faf5d52651ef142256e10d132dc8c5ee6a01f8ca1de22f4bbe7e668c4b0bb35cd9fe94a1ffdf18e8e60994d
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
92KB
-
Filesize
92KB