Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 09:16

General

  • Target

    395c71b238d7803eec508620497afed3_JaffaCakes118.exe

  • Size

    261KB

  • MD5

    395c71b238d7803eec508620497afed3

  • SHA1

    2ff8845c9b44a1dbe3e2a933c4da4af9eb182b2c

  • SHA256

    04c6ede0cabd7387bbfaf3262577a1295c3b966a5f0901e9d67149a7c9c90c54

  • SHA512

    d30c672ee753dd951a931691ba4a8da7b2a773d556e28d3dbba16a6b23c58a329923ee5690d9bff2cdaf8a3376a16b910016a755cd1772d9d589614162fc9235

  • SSDEEP

    6144:bKpdcCrTqqR6p07tTQzaDOPD9OvBmvBuuTMM6TuGKx:b0drtCs1XOIs06QM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\395c71b238d7803eec508620497afed3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\395c71b238d7803eec508620497afed3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\nsz4661.tmp\northstar.exe
      C:\Users\Admin\AppData\Local\Temp\nsz4661.tmp\northstar.exe /u4f96c0af-ae48-469a-a08c-2bb95bc06f2f /e2835070 /dT201302082034
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsz4661.tmp\System.dll

    Filesize

    21KB

    MD5

    5ebc73650256e9c8ddbcda231db829a1

    SHA1

    988d4535e18754ab2a6248abae96c5697d7dbcd5

    SHA256

    1eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493

    SHA512

    b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270

  • C:\Users\Admin\AppData\Local\Temp\nsz4661.tmp\northstar.exe

    Filesize

    255KB

    MD5

    941090fa4708b4edfdb00a3becff2292

    SHA1

    70725f96fd5130906a1eef46917c7ab9c273ee9e

    SHA256

    c9b63ef25a42d80a65e4bce19257b89e1b6613bbd5aa07a10098da6a024dd2b2

    SHA512

    d6faec9cd75ff6b8465ae8deb48e9119e52e02e7dab60877182c906a55982e1f61b597a17d2ff9cf9e92999bcd3aad7e1f43ab7134a277df1f829cf0b089da80

  • C:\Users\Admin\AppData\Local\Temp\nsz4661.tmp\northstar.narf

    Filesize

    100KB

    MD5

    655c3c9d00be9c5571e885ab6f92b815

    SHA1

    4fc77d273145dafc09156c048a7943b938ce492c

    SHA256

    9d4c69c1804596b0a2ba67cdaf25e61683f967505af94bf74d24a39695c31981

    SHA512

    76940e6d5bfc7781f401ef14b6b498b17b1ee36691635afe632511022fc012ff9987b9fcb7234b7f64e01254e5682b5026a944ba7965413a973c3b09df3852ab

  • C:\Users\Admin\AppData\Local\Temp\nsz4661.tmp\nsUnzip.dll

    Filesize

    146KB

    MD5

    77a26c23948070dc012bba65e7f390aa

    SHA1

    7e112775770f9b3b24e2a238b5f7c66f8802e5d8

    SHA256

    4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43

    SHA512

    2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065

  • memory/756-36-0x00000000741E0000-0x0000000074791000-memory.dmp

    Filesize

    5.7MB

  • memory/756-25-0x00000000741E0000-0x0000000074791000-memory.dmp

    Filesize

    5.7MB

  • memory/756-24-0x00000000741E0000-0x0000000074791000-memory.dmp

    Filesize

    5.7MB

  • memory/756-37-0x00000000741E0000-0x0000000074791000-memory.dmp

    Filesize

    5.7MB

  • memory/756-38-0x00000000741E0000-0x0000000074791000-memory.dmp

    Filesize

    5.7MB

  • memory/756-39-0x00000000741E0000-0x0000000074791000-memory.dmp

    Filesize

    5.7MB

  • memory/756-41-0x00000000741E0000-0x0000000074791000-memory.dmp

    Filesize

    5.7MB

  • memory/756-23-0x00000000741E2000-0x00000000741E3000-memory.dmp

    Filesize

    4KB

  • memory/1988-49-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB