Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 18:29

General

  • Target

    7a17dfe6888695511cecb4fd37c297b2_JaffaCakes118.exe

  • Size

    484KB

  • MD5

    7a17dfe6888695511cecb4fd37c297b2

  • SHA1

    29eaef941d3dff65d2224d24f6dc99690ddffd5f

  • SHA256

    cce9695bdbf64377264d6afee73cb26e178ee87dfc42f5543ad8b4f5a5587fd8

  • SHA512

    5e1914db199a532c18ee30908011ac0aef7a1154806a87948a05d44c52edfa228623a5cd326a18fcf828ecc8bde8f00019b6a182960fabf394dda37a839a196b

  • SSDEEP

    6144:WO0kVCPhlSXHWu/UqaJiXFBGBXrbD0LArl6KDOPVjoFX/iQZOP/OvXEx8a0qbwjv:XN6Ail6/VjoFX6eyx8a+jv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a17dfe6888695511cecb4fd37c297b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7a17dfe6888695511cecb4fd37c297b2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
      C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1968
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {D159A3EA-59D0-467F-960E-C0AD28456C16} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
        C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
            PID:2748

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • \Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe

              Filesize

              484KB

              MD5

              7a17dfe6888695511cecb4fd37c297b2

              SHA1

              29eaef941d3dff65d2224d24f6dc99690ddffd5f

              SHA256

              cce9695bdbf64377264d6afee73cb26e178ee87dfc42f5543ad8b4f5a5587fd8

              SHA512

              5e1914db199a532c18ee30908011ac0aef7a1154806a87948a05d44c52edfa228623a5cd326a18fcf828ecc8bde8f00019b6a182960fabf394dda37a839a196b

            • memory/1228-62-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-64-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-57-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-58-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-59-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-60-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-61-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-72-0x000000000041D000-0x000000000041E000-memory.dmp

              Filesize

              4KB

            • memory/1228-73-0x0000000000400000-0x000000000047D000-memory.dmp

              Filesize

              500KB

            • memory/1228-65-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-63-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-66-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-67-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-68-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1228-69-0x00000000002B0000-0x00000000002B1000-memory.dmp

              Filesize

              4KB

            • memory/1968-50-0x0000000000060000-0x0000000000080000-memory.dmp

              Filesize

              128KB

            • memory/1968-49-0x0000000000060000-0x0000000000080000-memory.dmp

              Filesize

              128KB

            • memory/2188-4-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-10-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-15-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-14-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-13-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-12-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-11-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-9-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-8-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-7-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-6-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-5-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-16-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-3-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

              Filesize

              4KB

            • memory/2188-17-0x0000000001DC0000-0x0000000001DF0000-memory.dmp

              Filesize

              192KB

            • memory/2188-19-0x000000000041D000-0x000000000041E000-memory.dmp

              Filesize

              4KB

            • memory/2188-20-0x0000000000400000-0x000000000047D000-memory.dmp

              Filesize

              500KB

            • memory/2520-44-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-39-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-33-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-34-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-35-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-36-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-48-0x0000000000400000-0x000000000047D000-memory.dmp

              Filesize

              500KB

            • memory/2520-37-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-45-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-38-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-40-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-41-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-43-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2520-42-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

            • memory/2748-74-0x0000000000060000-0x0000000000080000-memory.dmp

              Filesize

              128KB

            • memory/2748-75-0x0000000000060000-0x0000000000080000-memory.dmp

              Filesize

              128KB