Analysis

  • max time kernel
    136s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 18:29

General

  • Target

    7a17dfe6888695511cecb4fd37c297b2_JaffaCakes118.exe

  • Size

    484KB

  • MD5

    7a17dfe6888695511cecb4fd37c297b2

  • SHA1

    29eaef941d3dff65d2224d24f6dc99690ddffd5f

  • SHA256

    cce9695bdbf64377264d6afee73cb26e178ee87dfc42f5543ad8b4f5a5587fd8

  • SHA512

    5e1914db199a532c18ee30908011ac0aef7a1154806a87948a05d44c52edfa228623a5cd326a18fcf828ecc8bde8f00019b6a182960fabf394dda37a839a196b

  • SSDEEP

    6144:WO0kVCPhlSXHWu/UqaJiXFBGBXrbD0LArl6KDOPVjoFX/iQZOP/OvXEx8a0qbwjv:XN6Ail6/VjoFX6eyx8a+jv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a17dfe6888695511cecb4fd37c297b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7a17dfe6888695511cecb4fd37c297b2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
      C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3120
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:3224
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1564
      • C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
        C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:4628

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\extvisual\9a19dfe8888897711cecb4fd39c299b2_LaffaCameu118.exe

                Filesize

                484KB

                MD5

                7a17dfe6888695511cecb4fd37c297b2

                SHA1

                29eaef941d3dff65d2224d24f6dc99690ddffd5f

                SHA256

                cce9695bdbf64377264d6afee73cb26e178ee87dfc42f5543ad8b4f5a5587fd8

                SHA512

                5e1914db199a532c18ee30908011ac0aef7a1154806a87948a05d44c52edfa228623a5cd326a18fcf828ecc8bde8f00019b6a182960fabf394dda37a839a196b

              • memory/2928-68-0x0000000000400000-0x000000000047D000-memory.dmp

                Filesize

                500KB

              • memory/2928-67-0x000000000041D000-0x000000000041E000-memory.dmp

                Filesize

                4KB

              • memory/2928-52-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-53-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-54-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-55-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-56-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-57-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-58-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-59-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-60-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-61-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-62-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-63-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/2928-64-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                Filesize

                4KB

              • memory/3120-39-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-33-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-32-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-30-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-29-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-41-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-40-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-44-0x0000000000400000-0x000000000047D000-memory.dmp

                Filesize

                500KB

              • memory/3120-38-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-37-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-36-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-35-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3120-34-0x00000000021D0000-0x00000000021D1000-memory.dmp

                Filesize

                4KB

              • memory/3224-46-0x0000025A80F60000-0x0000025A80F80000-memory.dmp

                Filesize

                128KB

              • memory/3224-45-0x0000025A80F60000-0x0000025A80F80000-memory.dmp

                Filesize

                128KB

              • memory/4244-10-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-11-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-18-0x0000000000400000-0x000000000047D000-memory.dmp

                Filesize

                500KB

              • memory/4244-4-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-5-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-6-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-7-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-8-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-19-0x00000000029A0000-0x00000000029D0000-memory.dmp

                Filesize

                192KB

              • memory/4244-9-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-17-0x000000000041D000-0x000000000041E000-memory.dmp

                Filesize

                4KB

              • memory/4244-12-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-13-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-14-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-15-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-16-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4244-3-0x00000000021A0000-0x00000000021A1000-memory.dmp

                Filesize

                4KB

              • memory/4628-69-0x000001CB3DC50000-0x000001CB3DC70000-memory.dmp

                Filesize

                128KB

              • memory/4628-71-0x000001CB3DC50000-0x000001CB3DC70000-memory.dmp

                Filesize

                128KB