Analysis

  • max time kernel
    134s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 15:11

General

  • Target

    8129cc5108ffb4d41a878b423762f381_JaffaCakes118.exe

  • Size

    312KB

  • MD5

    8129cc5108ffb4d41a878b423762f381

  • SHA1

    2234dfb09f477146e05860a1704464a87d4e78c7

  • SHA256

    7ca83defae07088ed1f31669bf457decbd899db46463739f0eb8826d19fbfbf2

  • SHA512

    64e51a914c9d35ce2cfa798c96c2f0e7b5986b0b640b12d186f0467a238f896c4cb344f063ba973eee1ff8dc3295f69e897eea864535242235953c4c06df97cf

  • SSDEEP

    6144:Lweks+CRnAGLyo8MdROCZVtSH7zsKeEM9NBJZY5:UeknClASyo8MdRO2tSH7zs2

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8129cc5108ffb4d41a878b423762f381_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8129cc5108ffb4d41a878b423762f381_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2328

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\bhs28E4.tmp

          Filesize

          242KB

          MD5

          c4a0d2165a51256cc6eac8f5070d4094

          SHA1

          07ed3c4d0d4e168b05784a8204e1727a9db0eb74

          SHA256

          54efdef3fbaa88bc58b7a4062d742be6a745bd73d50d80a3e3556e79578bd378

          SHA512

          c03bd2c24c2754c6ccb8ee18fac486438f984374bac3654356905cb4a8c5e823ba250ea0245b2347e43f459567d3281a6ca09c4d81d014f3263456a211012a4f

        • memory/2328-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

          Filesize

          4KB

        • memory/2328-3-0x0000000000390000-0x00000000003D2000-memory.dmp

          Filesize

          264KB

        • memory/2328-4-0x00000000744D0000-0x0000000074BBE000-memory.dmp

          Filesize

          6.9MB

        • memory/2328-5-0x00000000744D0000-0x0000000074BBE000-memory.dmp

          Filesize

          6.9MB

        • memory/2328-6-0x00000000744D0000-0x0000000074BBE000-memory.dmp

          Filesize

          6.9MB

        • memory/2328-7-0x00000000744D0000-0x0000000074BBE000-memory.dmp

          Filesize

          6.9MB

        • memory/2328-13-0x000000000B080000-0x000000000B826000-memory.dmp

          Filesize

          7.6MB

        • memory/2328-18-0x00000000744DE000-0x00000000744DF000-memory.dmp

          Filesize

          4KB

        • memory/2328-19-0x00000000744D0000-0x0000000074BBE000-memory.dmp

          Filesize

          6.9MB

        • memory/2328-20-0x00000000744D0000-0x0000000074BBE000-memory.dmp

          Filesize

          6.9MB

        • memory/2328-21-0x00000000744D0000-0x0000000074BBE000-memory.dmp

          Filesize

          6.9MB