Analysis

  • max time kernel
    145s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 06:49

General

  • Target

    49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    49df499ce823e33e888b896d894fd74b

  • SHA1

    0f8b3ffc457df9f8221bdc21ba426c426bd22490

  • SHA256

    aa7c5e6e9e377301576f0ce37320b915d35f4c2b22eb9926f2ca5622e0fc707b

  • SHA512

    5bd721b29be5523189955bb59bb50dfd03d683dbb7eff80f0036da7e205449f164a34767841edb1140aa7eba2389ab52b913b876c527dae450a4f3b2e687371f

  • SSDEEP

    24576:ZMMpXS0hN0V0HzDyo1tj9E6Ehg7mM+M6RkMkIM7gE6Eh67s:Kwi0L0q7tz0g7mM+M6RkMkIM7I067s

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49df499ce823e33e888b896d894fd74b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2564
    • C:\Users\Admin\AppData\Local\Temp\MZ
      C:\Users\Admin\AppData\Local\Temp\\MZ
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.exe

    Filesize

    500KB

    MD5

    ef5dbcc9ebb9da8424ef8b23bc8a3833

    SHA1

    14e6f1f640588775850b6dfcbd5b411176d21d0c

    SHA256

    02e4519b9e03180a92457dac30799dbe8b856045e755667f202c71882857e79c

    SHA512

    236ab86cb2c6296705bbbd0379ac6dd50c1075bdc2017e839e9038e198382663c2c52384896ac5abeea4569acfa0533ce8eb9a47d1a8b58283051679e443aad7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    992B

    MD5

    6f7d124b2d61af58808509c41170a318

    SHA1

    9ae05c19fd51ebc4c43874022d4b935d407213ed

    SHA256

    1afd12ac2e519abb863565763a0a4b7db2728c16774b12045b69620b054d7048

    SHA512

    8fb8df4dea1df4294fcc59bfdeed3e9335a41a37768712cd56eb4e62b63a8496bcc4559f026d996e2239b2a7b89fce02302e0d6e0a0a1255a59a8bdc465f0ee1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    950B

    MD5

    1693bc729747584a3b30fcf3af7862be

    SHA1

    b66380a52cef17bc7e547a280244562cba1634cc

    SHA256

    8a1ad8fe0bf6424e236f9b649d763191e483ecfea333ae83f8817756f2d7079c

    SHA512

    003894e0a91aecc092ae7853db1fb96f55107f40d4023ab4a77b8a336c186a5fdeeb585db3e9c3586d813e3187e378e29daa050c343b00271ccf1ebb93562c6e

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • \Users\Admin\AppData\Local\Temp\MZ

    Filesize

    1.1MB

    MD5

    49df499ce823e33e888b896d894fd74b

    SHA1

    0f8b3ffc457df9f8221bdc21ba426c426bd22490

    SHA256

    aa7c5e6e9e377301576f0ce37320b915d35f4c2b22eb9926f2ca5622e0fc707b

    SHA512

    5bd721b29be5523189955bb59bb50dfd03d683dbb7eff80f0036da7e205449f164a34767841edb1140aa7eba2389ab52b913b876c527dae450a4f3b2e687371f

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    500KB

    MD5

    1b24107c65331bd345824657e63ac30b

    SHA1

    9dcc11e7252488266d4e3f0a6f91b9bd5ab7f7a4

    SHA256

    50e25be03315cf2f0c4d7f193d092dde70128b3d2ad7dfb601357cbf1d922855

    SHA512

    58b11ab4ce4f7153f499e7b11530d4661f669e245c079dc8ea36268e812c933cd6020d70dce4b0b7a2e4c356fb0577cf39de848da1de6252982eaf0080ac888b

  • memory/2196-0-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/2196-25-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-325-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-343-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-374-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-365-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-253-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-355-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-263-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-243-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-271-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-335-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-285-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-9-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/2564-295-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-311-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2564-305-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-336-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-344-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-316-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-286-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-326-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-274-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-296-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-264-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-306-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-254-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-356-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-20-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2668-366-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-244-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2668-375-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB