Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 06:53

General

  • Target

    3e3c49a843c12052829f2009e9371142_JaffaCakes118.exe

  • Size

    876KB

  • MD5

    3e3c49a843c12052829f2009e9371142

  • SHA1

    bc5155fff8bfaf8c932f4997d7bdb85e033faea6

  • SHA256

    243f022d90c9f30d5b8786479469a6c23ef1a97ee536f1cfd641afebb7b6d327

  • SHA512

    50f1a970353524ec10cf13e4c1ee31b251f290fe4e51f57361b3d8a34cf129e518fd4b281f068839d42f7b7774ad6aa4834468215998073475ce8dc1d851580e

  • SSDEEP

    24576:qpMLKmtvPyHu73LQqdbu4y9pNg4W7HMlG3bOAHCkbA:YiKmHyOrLjxPp7sGO

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e3c49a843c12052829f2009e9371142_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3e3c49a843c12052829f2009e9371142_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\3e3c49a843c12052829f2009e9371142_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3e3c49a843c12052829f2009e9371142_JaffaCakes118.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Users\Admin\AppData\Local\Temp\3e3c49a843c12052829f2009e9371142_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3e3c49a843c12052829f2009e9371142_JaffaCakes118.exe"
        3⤵
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2264

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\SVDr7CIqP0uwlYTrESF\extramod.dll

          Filesize

          73KB

          MD5

          cf543e36bd516a35bd9a4b53a298158b

          SHA1

          567b09bce55e272d53f4974d84a096a8562cbda8

          SHA256

          8e003b6fdd64f635af7e6fa013e8e50af7413e68e92e3820c70565decc542b74

          SHA512

          dd19553abe81f2ba5035fd41ae41a996def419a2d554a470cfe9f8ddb8806e4602eaab0502fa4f4657330902a22eebe33a85c2f60ded3f9948620b36e60cae69

        • \Users\Admin\AppData\Local\Temp\SVDr7CIqP0uwlYTrESF\loading_screen.dll

          Filesize

          5KB

          MD5

          44dac7f87bdf94d553f8d2cf073d605d

          SHA1

          21bf5d714b9fcab32ba40ff7d36e48c378b67a06

          SHA256

          0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

          SHA512

          92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

        • \Users\Admin\AppData\Local\Temp\SVDr7CIqP0uwlYTrESF\lua51.dll

          Filesize

          494KB

          MD5

          f0c59526f8186eadaf2171b8fd2967c1

          SHA1

          8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

          SHA256

          6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

          SHA512

          dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

        • \Users\Admin\AppData\Local\Temp\SVDr7CIqP0uwlYTrESF\shared_library.dll

          Filesize

          200KB

          MD5

          a61f3c8ec0f8050209c81af6feca8826

          SHA1

          0ec17fa1047e605882d9c0cb60af866837662644

          SHA256

          b3b1863d16b48c4f575776778faba1e6a3b77bc42371b518a6f517789de40f91

          SHA512

          b6154cb4fb6dd2cba0fd589c7db7765f36daea223ecfd87392caec9e671274f04ee280351b3e69cb8e839de4bd7f7a17cd04a5d624d81dbecfda6ec800c0cebd

        • memory/2264-5-0x0000000000250000-0x0000000000266000-memory.dmp

          Filesize

          88KB

        • memory/2264-10-0x0000000000310000-0x0000000000346000-memory.dmp

          Filesize

          216KB

        • memory/2264-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

          Filesize

          64KB

        • memory/2264-14-0x000000007EF90000-0x000000007EFA0000-memory.dmp

          Filesize

          64KB

        • memory/2264-20-0x000000007EF00000-0x000000007EF10000-memory.dmp

          Filesize

          64KB