Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 01:32

General

  • Target

    694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe

  • Size

    284KB

  • MD5

    694c8212ce7cf8e6fbbbefe183a9ad27

  • SHA1

    7715da16e471c92c6f09ee1a75968fc4411b2397

  • SHA256

    1d868e84fbc8e712a9c55beb9775a9d71a409caa4fc7098f77b96e3057c37756

  • SHA512

    d11799cad30ec4bf68713976de390e034fb405f88c259f22bc5ab3404a6d3a33084e6fb9124269415f11ba82369c286c6e72f2533385525c6fa32f1ecf479b0a

  • SSDEEP

    6144:pG1Af3k5aL3Lbii5bkgVuN+xSKV7Wkrsf7LsMKceSK:pGaf05a7XikbkgaISKVsVe3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\694c8212ce7cf8e6fbbbefe183a9ad27_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe
      "C:\Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe" -y -p24209C29-927D-4216-9B7E-2304351D788C
      2⤵
      • Executes dropped EXE
      PID:2632
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\\start.hta
      2⤵
      • Modifies Internet Explorer settings
      PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\loader.gif

    Filesize

    1KB

    MD5

    e88ebd85dd56110ac6ea93fe0922988e

    SHA1

    684a31d864d33ff736234c41ac4e8d2c7f90d5ae

    SHA256

    379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

    SHA512

    211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

  • C:\Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\start.hta

    Filesize

    1KB

    MD5

    580c0c72b17ffcb9a626356f7393d89c

    SHA1

    7a5e408abd57f8e2cc6f4fdd7f116fac04eb8a83

    SHA256

    879b0caf66aca0fc0f9558a09d86480a64bf34cacd5094a572d779a6d65bf00b

    SHA512

    9fc56f0916b75e03bca8654a2243fc0063a5baece46f648d67cb6f1876aa6aedebc55c1f1458baf2b2883ab1ec91973b6099918aae3269b91b76e627d6b19dac

  • \Users\Admin\AppData\Local\Temp\eb3a954b-8e6c-45c6-9d18-2b4519b99c08\22960FD3-14E8-4DA4-B78A-B582DCDD0797.exe

    Filesize

    150KB

    MD5

    069687d64f5ea09d060799c132243f15

    SHA1

    13b9041fd970aea78c2eac9e664e0e18b7956548

    SHA256

    90252a4cc1ceb2c78b65bb4833b83a5ee81600a27ea337f908d16bbcb7018c16

    SHA512

    7ed2b27e808c46723f56a064bea544bb45476304900dd9dbc5ccb4891dc3e288117eb2cb218fb9b6351296e1a5dcc5a7029ceb47f9bbac0e69376064fd831906