Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 00:59

General

  • Target

    7b2a574fd7a6a6c41e47c318ed073c78_JaffaCakes118.exe

  • Size

    314KB

  • MD5

    7b2a574fd7a6a6c41e47c318ed073c78

  • SHA1

    1f7a83121b27c9f7b8bb05cd0961f1cde6166acc

  • SHA256

    5c68aacbfc2af4060a4f2aacb91941ba92325518b25ac15928c40b808a3fa2b5

  • SHA512

    2c8d89015480a41b175aa8d2bc2fe6e6fc89641db84656efe8aa9173b59eee7922ef656c6719b5b2d5dbd93ff7058b15215cdcef5794fac6028e5a28190a5ce0

  • SSDEEP

    6144:grAbUzkuvcBYC47l2xn88NEymFTYO67qzVxzRRw6:gr1kuveY35YO67Wxz7w6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b2a574fd7a6a6c41e47c318ed073c78_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7b2a574fd7a6a6c41e47c318ed073c78_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1576

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\TsuA331EDA5.dll

          Filesize

          269KB

          MD5

          af7ce801c8471c5cd19b366333c153c4

          SHA1

          4267749d020a362edbd25434ad65f98b073581f1

          SHA256

          cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

          SHA512

          88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

        • \Users\Admin\AppData\Local\Temp\{B798E219-CB2F-4D1B-AFF0-830D6C7BC0EF}\Custom.dll

          Filesize

          91KB

          MD5

          71ffb31fe40a3f10913982ee89fa764c

          SHA1

          c17fa19479a7559f666a30d2932a2b9d540bd0ee

          SHA256

          b0e3f473796f639cab1354971740405bc39a096839ac53b4dfaae2c4acb71599

          SHA512

          6913a278fa38b9cef7b317ed7eab7773447dbc786d60531455c5cb28d82c677b472f2c50b3b9e1a8a71290757f064c828721633fb5f7bef47897dc740b1567ab

        • \Users\Admin\AppData\Local\Temp\{B798E219-CB2F-4D1B-AFF0-830D6C7BC0EF}\_Setup.dll

          Filesize

          170KB

          MD5

          449e327ad7b62d3a446b1d5c97c76dea

          SHA1

          834bfc7bef4a08ddf4dfaf0e1a1f424b66456903

          SHA256

          2d0f7824d781e1372ea5a931dc5aba9a76164adfbf95d0a50a785403bc0a2e2f

          SHA512

          f99fbd4d5e2084a91fc21a2467a447350b14a61940c30482f67c28877863693c41f9e928a39752e7fecffc8bfba609b887ddaa5bbd70e1fec18483bf1e85e986