Analysis

  • max time kernel
    147s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 04:52

General

  • Target

    8cefdf73de8d64c112c99a63899ef219_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    8cefdf73de8d64c112c99a63899ef219

  • SHA1

    0b55f682803bd1d7d99766dc41f719ba86c164ef

  • SHA256

    23aa88fe694bb25d999afd991a0c712695bf8abe48ed4353f317436691270b0e

  • SHA512

    ca005854af18679601836320aa7ef1e80737f639ee01b7a8aa860f1bcabe1db170136b68e13311a6a55dcc9f0ea193294390582b010961d38f74efb80d183889

  • SSDEEP

    49152:oVlqV3oGdm6Wywxc7fbse+krvHgAcU8xLuVFhMPZmsy:oVlooJzRc7fbse+j9UALuVjB/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cefdf73de8d64c112c99a63899ef219_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8cefdf73de8d64c112c99a63899ef219_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\INSA4E7.tmp
      C:\Users\Admin\AppData\Local\Temp\INSA4E7.tmp /SL3 $80120 C:\Users\Admin\AppData\Local\Temp\8cefdf73de8d64c112c99a63899ef219_JaffaCakes118.exe 1828395 1831809 61952
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2836

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\INSA4E7.tmp

          Filesize

          377KB

          MD5

          ef80f42a048f92263f758f14b09fa30d

          SHA1

          e250058636dee689d6a935d71c0f462e10457239

          SHA256

          a44707ed7ababc6ca81355e9a6afe0e5095d01f1c72ef7b37681447036da518e

          SHA512

          933b43e14cbb734ff48d9b0b06671f15e458633a4e4d52420dd2eda258fc477ae17183a5d83d47da78272d1d6c7f9ba547729cd846ebec5eaf9963b2fce605ed

        • \Users\Admin\AppData\Local\Temp\is-TK4DL.tmp\_shfoldr.dll

          Filesize

          22KB

          MD5

          92dc6ef532fbb4a5c3201469a5b5eb63

          SHA1

          3e89ff837147c16b4e41c30d6c796374e0b8e62c

          SHA256

          9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

          SHA512

          9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

        • memory/1284-11-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

        • memory/2836-12-0x0000000000400000-0x000000000046A000-memory.dmp

          Filesize

          424KB