Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 12:54

General

  • Target

    3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe

  • Size

    993KB

  • MD5

    3a37860ff81fc1f7a9618757bbbcc9e4

  • SHA1

    16abe227b3cc35847fb0caffa6536d13bcafe41d

  • SHA256

    3626f2ec2137a5c30479baa33ec81e4eb1b3d018baf59200547e742b8b4a76e2

  • SHA512

    5a1efe72274501492c761af0b998562adc6e08fe866a992dda6e026f336175fa160c4753535a65d975546553f99a6b07137eee66163ac9dadfa64a06de0c214e

  • SSDEEP

    24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxX:dJ5gEKNikf3hBfUiWxX

Score
10/10

Malware Config

Signatures

  • Ammyy Admin

    Remote admin tool with various capabilities.

  • AmmyyAdmin payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    994KB

    MD5

    5589b3d6462a23ad068b72ab28c48f4e

    SHA1

    29a97e97f2de53456b85ccd75056791db9e29792

    SHA256

    8973555111e7b8ba82999b62bccfab12bbb2b652d6f6d7ce751d2fab00062503

    SHA512

    011afd98583452ecacd6acecf84f997fdec773b6bd82902068ecd3ef0f8cb631ecf54e18936a62589b00660129e70c343b05d55574dbb44aa1a1ccbe502620cc

  • memory/1524-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1524-1-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

    Filesize

    4KB

  • memory/1524-3-0x00000000027D0000-0x0000000002BD0000-memory.dmp

    Filesize

    4.0MB

  • memory/1524-7-0x0000000002D20000-0x0000000002D2A000-memory.dmp

    Filesize

    40KB

  • memory/1524-11-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2992-12-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2992-13-0x0000000000130000-0x0000000000131000-memory.dmp

    Filesize

    4KB

  • memory/2992-15-0x00000000026D0000-0x0000000002AD0000-memory.dmp

    Filesize

    4.0MB

  • memory/2992-16-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB