Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 10:29

General

  • Target

    3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe

  • Size

    70KB

  • MD5

    3f09fbc368f17edb61193d5db5ee0749

  • SHA1

    e6b725fcf7c69c251ca05b6fac7816c0b9579d52

  • SHA256

    253c088b88328696a1b70dd570fb0372c912a7b7a5eeb703d2cc7d29b2cdbf32

  • SHA512

    d068ca2291e4363ef070b0d2bfe81adc7eb656d978c97c22f7e6bd6b5a4b5a2939fe996753ce0d3cf7271cf45a346dfc9297e92bd00e4798804b9db37d0aa2b9

  • SSDEEP

    1536:CNCRz5fBMn24kEuqzcEjI+uYJU1YRqo1Wujp2zN5X:tiHkEuqdVBUEqo/l2zN9

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Deletes itself 1 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3f09fbc368f17edb61193d5db5ee0749_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\SysWOW64\svchost.exe
        "svchost.exe" path<<c:\users\admin\appdata\local\temp\3f09fbc368f17edb61193d5db5ee0749_jaffacakes118.exe>>path
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\SysWOW64\svchost.exe
          "svchost.exe" path<<c:\users\admin\appdata\local\temp\3f09fbc368f17edb61193d5db5ee0749_jaffacakes118.exe>>path
          4⤵
          • Modifies WinLogon for persistence
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Deletes itself
          • Adds Run key to start application
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          PID:2668

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\KB8777677\KB8777677.exe

          Filesize

          70KB

          MD5

          3f09fbc368f17edb61193d5db5ee0749

          SHA1

          e6b725fcf7c69c251ca05b6fac7816c0b9579d52

          SHA256

          253c088b88328696a1b70dd570fb0372c912a7b7a5eeb703d2cc7d29b2cdbf32

          SHA512

          d068ca2291e4363ef070b0d2bfe81adc7eb656d978c97c22f7e6bd6b5a4b5a2939fe996753ce0d3cf7271cf45a346dfc9297e92bd00e4798804b9db37d0aa2b9

        • memory/1528-8-0x0000000000BD0000-0x0000000000BE7000-memory.dmp

          Filesize

          92KB

        • memory/1528-14-0x0000000000BD0000-0x0000000000BE7000-memory.dmp

          Filesize

          92KB

        • memory/1528-11-0x0000000000BD0000-0x0000000000BE7000-memory.dmp

          Filesize

          92KB

        • memory/1528-7-0x0000000000BD0000-0x0000000000BE7000-memory.dmp

          Filesize

          92KB

        • memory/2668-21-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-20-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-66-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-59-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-36-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-26-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-15-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-17-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2668-18-0x0000000000BD0000-0x0000000000BED000-memory.dmp

          Filesize

          116KB

        • memory/2804-3-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2804-2-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2804-5-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2804-10-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2804-4-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/3216-0-0x00000000005C0000-0x00000000005C1000-memory.dmp

          Filesize

          4KB

        • memory/3216-1-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB