Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-05-2024 06:03

General

  • Target

    7fbabd1cad344037bc74435e16047984_JaffaCakes118.exe

  • Size

    715KB

  • MD5

    7fbabd1cad344037bc74435e16047984

  • SHA1

    9c086550c3ac8d6bf419e775d05f9dfe66ccf40d

  • SHA256

    130d90740b13384269fcad8a09f79dac8a6c7f5b4c824a1f1ef3dce6bb7dae4c

  • SHA512

    3e2e1f332490e0ec2aa0a2e427415c33b68836ad8f835f66de84f347f5872d1c2a93b1ceeeb869f44b746a71751649d938096c9e63a74f80a72c4998a6927379

  • SSDEEP

    12288:hVvp1zCjvwdhGb5OwuFU2ukrgxGiMMEdDF31u9XmrsFM/6cusfAzm:hVvDzCbYkZuW2TgkiM9dDnu92rcMycuU

Score
7/10

Malware Config

Signatures

  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fbabd1cad344037bc74435e16047984_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7fbabd1cad344037bc74435e16047984_JaffaCakes118.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\7fbabd1cad344037bc74435e16047984_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7fbabd1cad344037bc74435e16047984_JaffaCakes118.exe" /_ShowProgress /PrTxt:TG9hZGluZy4uLg==
      2⤵
        PID:3056

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ISH259~1\images\Grey_Button.png

      Filesize

      1KB

      MD5

      b2b464997f4db222765a07f8ba7909b2

      SHA1

      848b1b499e1ea1a9c3b3b4fdc94416fe450ae64a

      SHA256

      38de61d53651a817708fff0552aac6f9122e722b92da9ab1a455b547fae91123

      SHA512

      fbfd16e3dc5c1dd5d2fb692cb5edd5f6a66ca2c3715b3ca0ec74d81c3a3c796aeddcd1410507f7400b270ff12867186da5d55cdfc3b2562ca7b3e99515f005c9

    • C:\Users\Admin\AppData\Local\Temp\ISH259~1\images\Grey_Button_Hover.png

      Filesize

      1KB

      MD5

      5cd7a897da3d92981e4733b20750bba1

      SHA1

      d9309ef665065444e114e2743250307c87c98853

      SHA256

      4c10c9ab2b9efe61916b89d0d256d7c1ea53a618d970a04eb0bb89dfe8628822

      SHA512

      1d687c808e913fcbaac61df5bedd227c3efa4449fd713a565dae30ef11c2a1da2dacae56f5adac786d667764d7021d7d08d24440880404825a0e2979d9ea314f

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\bootstrap_22206.html

      Filesize

      156B

      MD5

      1ea9e5b417811379e874ad4870d5c51a

      SHA1

      a4bd01f828454f3619a815dbe5423b181ec4051c

      SHA256

      f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

      SHA512

      965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\css\main.css

      Filesize

      8KB

      MD5

      1f3ed200b3953dc1355a79e8e8fe5a66

      SHA1

      7187a5562b915188b79d4251f1f7504b60f014f5

      SHA256

      dadf15655a538281bc031b0b43d93407e8570a483a845f2bdd2aa79224bc5401

      SHA512

      43e96eb57395429563521c8c4017e3e1b75766f4d07c11761d17293ff4b8c06362f79e6e0077c92fdacc5d9514ba258b0ea99ad17641e4fd562451bc71345e36

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\css\sdk-ui\progress-bar.css

      Filesize

      506B

      MD5

      5335f1c12201b5f7cf5f8b4f5692e3d1

      SHA1

      13807a10369f7ff9ab3f9aba18135bccb98bec2d

      SHA256

      974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

      SHA512

      0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\BG.png

      Filesize

      2KB

      MD5

      335a24011568627de62082173f5fef77

      SHA1

      a03195faa0337c6d0c26d1bcb67f4c0a749fdc18

      SHA256

      e80b2232c24870b3d983d7576dd4bd117f7352b57b72ba61a0295abf4f60d71d

      SHA512

      cfef83e7ce53e115a6faba9c7295e9ad085df098a04edcf8162d42203fca15457d0471626e09e73953635279afc298a148108d43ffc29862f6c22815f8056a9e

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\Close.png

      Filesize

      207B

      MD5

      c222a4f3d309721c0898606960120266

      SHA1

      cdee967961a3ea87565ae7ca287be8ed20496160

      SHA256

      f638cc042b7ade6f43f2faf0077e020137562e559178396b7e975db39ac13df6

      SHA512

      db52224964ffd03fa65fddabea29d4f7c23840a18d1ad1028f228589c8c642280a762d2f4250159106f911455b8f0706a3b204dcbbb0484638d4f41f4f54a836

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\Loader.gif

      Filesize

      10KB

      MD5

      57ca1a2085d82f0574e3ef740b9a5ead

      SHA1

      2974f4bf37231205a256f2648189a461e74869c0

      SHA256

      476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

      SHA512

      2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\Pause_Button.png

      Filesize

      577B

      MD5

      84b37cb510f50c8fea812eb308d3f03f

      SHA1

      d141a79feb407506709f051e55c55438a12fd3b4

      SHA256

      7bf800336671204de36b7d1f6ceffdff830040f51d21bc44f220f68d72cf492b

      SHA512

      3222cb5772a4e9b20de253914c0856c7e6383567df68fcf287801f6f79248f65957515e7ec4a44db1fbe910afeae8ca3349295c4bdf03df6aabde36f2aaa6b5e

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\Progress.png

      Filesize

      104B

      MD5

      35a600a752d3074501de31a516860499

      SHA1

      51eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf

      SHA256

      14e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75

      SHA512

      046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\ProgressBar.png

      Filesize

      812B

      MD5

      eabb61abba55f80af418fa1128d1548d

      SHA1

      a5ee1d55de2cc60966039120c830fc19cefb0351

      SHA256

      717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1

      SHA512

      d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\Quick_Specs.png

      Filesize

      221B

      MD5

      07cd59b954e8495ad6cd6a7c11d2de86

      SHA1

      787aeda3eee8053705fb208a6b399b8340820b82

      SHA256

      6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb

      SHA512

      0159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\Resume_Button.png

      Filesize

      718B

      MD5

      9d31583bcfad58a6b9ddeaf44549a5e6

      SHA1

      98f4c693af708e02201de2aee31fe094dc3b0a9c

      SHA256

      e466a2db2f755d9eb68619439af37ff4e45559b7a3f476e226ab2a11aeadae1a

      SHA512

      9ddaaad53375f4d2874fe5c98b6782202d2bd975cdd9363796986dc7567368b94d9ec1aa3e839194097838b787bbd71d574540cf5b04fd04f10fa80d6a89e695

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\default_tb.png

      Filesize

      19KB

      MD5

      70e70599d4b853df0f12f6cb0e04695f

      SHA1

      6e3a721aef65625bf99b639800476150d262dd4b

      SHA256

      87af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0

      SHA512

      1efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920

    • C:\Users\Admin\AppData\Local\Temp\ish259478600\images\default_wi.png

      Filesize

      27KB

      MD5

      1cc2677e3e29e45e538985839cff2b42

      SHA1

      2dab653eb20be72b034a38dc1fcebbd18f079c86

      SHA256

      9216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f

      SHA512

      25575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f

    • memory/2236-235-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-225-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-166-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-165-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-159-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-189-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-160-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-161-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-158-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-7-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-0-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-3-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-4-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-5-0x0000000000401000-0x000000000040B000-memory.dmp

      Filesize

      40KB

    • memory/2236-320-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-260-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-261-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-257-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-254-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-217-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-218-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-220-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-221-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-167-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-226-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-224-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-223-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-228-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-230-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-231-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-6-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/2236-236-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-238-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-240-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-242-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-247-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-246-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-252-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/2236-253-0x0000000001D20000-0x0000000001E83000-memory.dmp

      Filesize

      1.4MB

    • memory/3056-248-0x0000000001C40000-0x0000000001DA3000-memory.dmp

      Filesize

      1.4MB

    • memory/3056-213-0x0000000001C40000-0x0000000001DA3000-memory.dmp

      Filesize

      1.4MB

    • memory/3056-216-0x0000000001C40000-0x0000000001DA3000-memory.dmp

      Filesize

      1.4MB

    • memory/3056-214-0x0000000001C40000-0x0000000001DA3000-memory.dmp

      Filesize

      1.4MB

    • memory/3056-215-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3056-211-0x0000000001C40000-0x0000000001DA3000-memory.dmp

      Filesize

      1.4MB