Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 04:46

General

  • Target

    8ced037d23d8b1244b5fc6c23456b51e_JaffaCakes118.exe

  • Size

    1.6MB

  • MD5

    8ced037d23d8b1244b5fc6c23456b51e

  • SHA1

    2ffedd9543c1d07ebdb8c230e25f1c8cc00ba7be

  • SHA256

    7bf29b9be4824ded16650f013462b9d20796242bcc568ccacf5e8ab2ca18a9b5

  • SHA512

    a1b398e011fb124474654184f69f5399ad3cab3ec2408bc7a8cd4ff3094188e0b126675aa31131a93bb3ef0d93504c19a66714b0ecae905dd0ea17e0095f6224

  • SSDEEP

    24576:l2BbEKosPAZ3ZOOKfs6NL0CpszqtPUfRQI5n5PmSGj69bA5rV4Yihe5Cpnb:ibz183QRNLTeqU9PGjebA5rOYiZnb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ced037d23d8b1244b5fc6c23456b51e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8ced037d23d8b1244b5fc6c23456b51e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\is-44CKT.tmp\8ced037d23d8b1244b5fc6c23456b51e_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-44CKT.tmp\8ced037d23d8b1244b5fc6c23456b51e_JaffaCakes118.tmp" /SL5="$30150,987588,70144,C:\Users\Admin\AppData\Local\Temp\8ced037d23d8b1244b5fc6c23456b51e_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3056

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\is-4IB0D.tmp\setupcfg.ini

          Filesize

          44B

          MD5

          c741945510787a9e290795c2ed37defc

          SHA1

          65b952219c62d4a604616e23e191febe83908720

          SHA256

          46406b102b107ca1551ea13d254c160adf24fea2b10993992a62df8a7eaef851

          SHA512

          2f1a2b6bf2c92e61597c146ba56db99fea49e74079fbc13b7e02355a79e3b1969baa2ce384ce94d8fb30ee363b1026afa53a2ef8f2b33b971074837fcc6b4764

        • \Users\Admin\AppData\Local\Temp\is-44CKT.tmp\8ced037d23d8b1244b5fc6c23456b51e_JaffaCakes118.tmp

          Filesize

          1.2MB

          MD5

          e7106fbf42fbc6d5b08a18ada4f781b4

          SHA1

          36d4a629f79d772c0b0df8bd2ae2ea09108d239d

          SHA256

          64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635

          SHA512

          adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845

        • \Users\Admin\AppData\Local\Temp\is-4IB0D.tmp\_isetup\_shfoldr.dll

          Filesize

          22KB

          MD5

          92dc6ef532fbb4a5c3201469a5b5eb63

          SHA1

          3e89ff837147c16b4e41c30d6c796374e0b8e62c

          SHA256

          9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

          SHA512

          9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

        • memory/2988-0-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/2988-2-0x0000000000401000-0x000000000040D000-memory.dmp

          Filesize

          48KB

        • memory/2988-47-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/3056-9-0x0000000000400000-0x0000000000536000-memory.dmp

          Filesize

          1.2MB

        • memory/3056-48-0x0000000000400000-0x0000000000536000-memory.dmp

          Filesize

          1.2MB