Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 20:36

General

  • Target

    7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe

  • Size

    254KB

  • MD5

    7e509afa2b8425b8c9618ccf20ca1f67

  • SHA1

    1668fa3e73cbc91b3ccdf5d8977e16ca201d3ce2

  • SHA256

    cad72d1d5aec829038a3206a3e5d55f33d2238d65541e7e660597be0c047d1cc

  • SHA512

    ce5d596f194f306ff34ffb410e0676b1fc235b3f77d70ee60fe96603b95720275e9ce29915d5dfe741ccbd4ac7dd4b73147c799c481947a1db4f3094c458f311

  • SSDEEP

    6144:FsaocyLCXr2QxeUPpbNdV0g74E/hJQAjDUfK9uX/:FtobcygeMp/OuLPQwQLv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\installer.exe
      C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\installer.exe ins.exe /dT201305141625 /e5106646 /aSCANIA /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\ins.exe
        "C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\ins.exe" /dT201305141625 /e5106646 /aSCANIA /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\12236C41CDDF9E40BA5606CDF086B821

    Filesize

    95KB

    MD5

    73c91338ca3968d94fa15ec72f5ad251

    SHA1

    106c43de5262e43c3fc2f1585d53e51a1cbb6ba2

    SHA256

    e62b5df07c0a54845940cf6105745077411cdd6e308553ac2dedb0006c521453

    SHA512

    d6dd958ced6dfab683cf9a7e1875a3f614b2328d5281825ee5ef188483001b6f9365cdabc42c81b36d78bba0609d2223e2906d5f7c4505f4b1599137d12e8027

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F39B5CFACECFDE48DB25BCA2231FAC6_D73FEE3C4E574541538B35CF985ADB66

    Filesize

    5B

    MD5

    4842e206e4cfff2954901467ad54169e

    SHA1

    80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

    SHA256

    2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

    SHA512

    ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    604B

    MD5

    5a1ab1871c1dd0bbe715482943c74be6

    SHA1

    da4ce17e39abb581883120980f00a91cb029127c

    SHA256

    5fab31aa7540eaebb07d0315e540564b06d612b4b4eb3f2a645fd86a59e6b37c

    SHA512

    88d80e7ffc33aadb7e28363aad82f51e78bc09ef3ef193a7acb867c825bf633b04bb623796e699262c2f1b40f339bc5277b5520f17d87b2d1f6724288330545d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12236C41CDDF9E40BA5606CDF086B821

    Filesize

    202B

    MD5

    cbb5f2387f8591efeee721d84236f5c2

    SHA1

    7f9e7d9f8488e420b3cfeacf03ec3318c12b7757

    SHA256

    a71327e4768e0d99b9bdf88fbe9a554c3a61b1916e71b8d07dfd971d197be2d9

    SHA512

    9d37c62a36eeac496ea3c840296d2cc324961f04664f18eb9f4d90b474467b33eee8d684910c7f461795d36e011daff04d649129f1929253a333c38d3695230c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_D73FEE3C4E574541538B35CF985ADB66

    Filesize

    490B

    MD5

    a69f4a23faaa2e6cd0c54d3e6e2e956f

    SHA1

    9d218b384655f51502714ce90c9596423de079dd

    SHA256

    fa71f456dc2c4f3e2f26189795f3ca625e10d5c81b3f5ef2a7b8e105f52121f0

    SHA512

    bc55659501491194c30e4b89c0fb388e7b74d98d541e24e2dc85cb651cf00203d1f8d5e2bb6fdf70d981ecad7d71760d1512b80ab2e19cb9420f64cbaf7265e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_F0E2901B5CB9DFCB03318B8D06C40A30

    Filesize

    412B

    MD5

    c513192d789240a37700c9a94568ca1b

    SHA1

    c7f1934b3b21eb0bb259d9f9e80a03a54dd388d7

    SHA256

    c7b907cae8881b8521eca38ee43f83bc154c99326db3f4cbf87e133f940c45b5

    SHA512

    54745f74dc3ee2b3169a770b14f318ea3d974df9db13c49658e3d1d575f86a9073a621725abd78472c8026c5e0ad8480f30293d9ae8986a7a0f83e14d644ab3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    188B

    MD5

    aae5b8795a58c03a5424cb9b57c7dec8

    SHA1

    e254620478fa3ae59861dd32e670c7b642bebc05

    SHA256

    f01993a421bb2f706a55888530ea535f082ebaa9ec7d9feb0e0338b58089b718

    SHA512

    f1534900d2e37f4946385d0aad3941d71e99be2e615a627b519d47ac855dcf4e084800dedd582b9289df886ecb1fe30117b45b8d3c68ec5768ff08fdb9beb1c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    7f272ab52da68e528a08e26a5a1cd917

    SHA1

    2681c366df68cd2b3e2e9dc3ec567638cfd48cd0

    SHA256

    22de4d63475522dcdda89b92303c70776ee3e6cbf31242b49767950b4a89fa6d

    SHA512

    c89d885f66b6c0e88ffd61228d1fbc663b84a9769d5b4d444c80c6bdf76dcae09cf4cea66682572860124063a193ece3ae80acf8578b321e03b4b3151392ee2a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

    Filesize

    404B

    MD5

    3985c0a7ee80a9e55e25df67cac0cf76

    SHA1

    b28f3538867709d3b9321897637bda0fc4eaa386

    SHA256

    9c85e0ed7519843a90889a350b9144502a6e223488f0946171e66bf87ec15aca

    SHA512

    b7e58dd8dfdf6106899585b9e13eb3b7dfe3a859ae6a7a23989afc03c64f213cf28b205934ff1356f2de68b011a0b7898c013771554d177a61e26d7588f9d7ac

  • C:\Users\Admin\AppData\Local\Temp\TarCC4.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\ins.exe

    Filesize

    155KB

    MD5

    150c2ea75d37ed3111f503adc5b6edb8

    SHA1

    87b2e37738818ddea292699ae26b2ac291ff1e7f

    SHA256

    cdaff7706a3c4d46ae4afdfd675fce9b06bcdbe616073b92dc28fbf58c0b6adf

    SHA512

    bcf0e1401d2f31b9bbd93bd3005716419c832c467fb76c21e40195ab38847022db387de49b4c7494780f04c511138631e2d8e1ac0e241bb835771bec72b815db

  • C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\installer.exe

    Filesize

    198KB

    MD5

    7950260db65cd017c5cf1b925d2fcd83

    SHA1

    6695ec132f781e2cabf880fe25068cbe0a75a761

    SHA256

    2b18da136c09287e5a8e29821b1301e11bfd0a8c7d5633b63a115681adbc9edc

    SHA512

    ed98e20dc18c4fcb249d8a057cf0856d3cd48012218e95053672e8113c310e8f524b33139a6064e5593551e69b5db04a958bbda1a9aeca4b850b34a31e9f5356

  • \Users\Admin\AppData\Local\Temp\nsdB87.tmp\nsExec.dll

    Filesize

    8KB

    MD5

    249ae678f0dac4c625c6de6aca53823a

    SHA1

    6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

    SHA256

    7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

    SHA512

    66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

  • memory/1740-109-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/3032-86-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

    Filesize

    9.6MB

  • memory/3032-78-0x00000000021E0000-0x000000000220E000-memory.dmp

    Filesize

    184KB

  • memory/3032-21-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

    Filesize

    9.6MB

  • memory/3032-13-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

    Filesize

    4KB

  • memory/3032-80-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

    Filesize

    9.6MB