c5426093a0e4e3b8e6ab5c5ec32112cab8f5dba0acbd87bad9cda53966d3f542

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe
Size 212KB
Sample240529-mk4cbscd46
SHA256 c5426093a0e4e3b8e6ab5c5ec32112cab8f5dba0acbd87bad9cda53966d3f542
MD5 807045d680e507d7d1d0dc488530b0e3
SHA1 f717bdbdc05c43b76cc4b7ead6116b5b2598d346
SHA512 448ac3c19180d9318839b2c8fe17a17055e67b02f8d0ada0cbb8c9ec42b3de627807c92ade10a98ccdf229bed49d123a91d6ac16576b7092fc9bcb214c51ca90
SSDEEP 6144:We34y2pbTh+3pwLpAKKi8A//t4V1TLAo/o5b77ClFxv:kvh+3KaltAnIhLB/m4v
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	dlmgn.exe

Loads dropped DLL 1 IoCs

pid	Process
1992	807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2412	dlmgn.exe
2412	dlmgn.exe
2412	dlmgn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	dlmgn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2412	dlmgn.exe
2412	dlmgn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2412	1992	807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2412	1992	807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2412	1992	807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe	28
PID 1992 wrote to memory of 2412	1992	807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\nso19C9.tmp\dlmgn.exe
  C:\Users\Admin\AppData\Local\Temp\nso19C9.tmp\dlmgn.exe "C:\Users\Admin\AppData\Local\Temp\807045d680e507d7d1d0dc488530b0e3_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab585F.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab585F.tmp
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar58F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar58F2.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dlmgn.exe.config

Path C:\Users\Admin\AppData\Local\Temp\nso19C9.tmp\dlmgn.exe.config
Size 291B
SHA256 b50e8b399b9560285ec9572c1490613cdbc4d5ad4ac29db955c45c10a28b04fc
MD5 7f9dda91f4aada0a673991e0a0d04b7a
SHA1 9736abd42acff7db5b0551294f533dcb1a1a5cf7
SHA512 d9de3d0204ae178972259cec7882845f654dad9082a20aa629c47b93f0e9d71e568e901d20c68e14a48ddd29f72b857b8509c401a16c65d8f37b5485ae0cdb1e
MD5 SHA1 SHA512

Submit Download

dlmgn.exe

Path \Users\Admin\AppData\Local\Temp\nso19C9.tmp\dlmgn.exe
Size 369KB
SHA256 9c362ee61694e130bd904bfcf7c32c33851ab106e5b0121f800c31e42636d870
MD5 3c8fcdd5824e8194f999e9ca50c3c751
SHA1 89ffa620df2c41641dcb4af815c0e381dcd2a4da
SHA512 dc6b2ceb1b2847f53f866a154a6ace2faf3782ce74df4ed3920fbc73994796d0518bc1ef06648d4800e1ace8462d1af11cdb8b5ecbbf2d5d3389e2a439764f2d
SSDEEP 6144:CRhs1cwmi3K1L9E5ThjLhBj7JpKlgGOaGznraFJhn6I7:CDs+wmiKw1nfK1OucI7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2412-6-0x000007FEF594E000-0x000007FEF594F000-memory.dmp

Download

memory/2412-8-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Download

memory/2412-63-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/2412-64-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Download

memory/2412-65-0x000007FEF594E000-0x000007FEF594F000-memory.dmp

Download

memory/2412-66-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Download

memory/2412-67-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Download