Analysis

  • max time kernel
    134s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02-06-2024 13:09

General

  • Target

    8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118.exe

  • Size

    457KB

  • MD5

    8e2ee1038a38f7f0b5537a965e366b52

  • SHA1

    f5d841826836b706032de4a11cc69e94c4fb821b

  • SHA256

    1f3fc7159fce7bca1fb0b6b740dea75749c68194d0684dd0167de5671c261ead

  • SHA512

    7ac12f42efb211eceb17b76b9aaf80079ccd6412be4e0a51a5c75f40682d7d0c124480de52cebc87f0f308301c376e2c7adb5c3555795831a6a47f521cadb8e1

  • SSDEEP

    6144:iwt1iI9T4gh8trVcFi2M/E1y6GlLICuqgX9MqDfQ8M:iG1iMT4wAcFtM/wy6SLg3DY8M

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8e2ee1038a38f7f0b5537a965e366b52_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:2724
  • C:\Windows\SysWOW64\lookroyale.exe
    "C:\Windows\SysWOW64\lookroyale.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\SysWOW64\lookroyale.exe
      "C:\Windows\SysWOW64\lookroyale.exe"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2116-6-0x0000000000270000-0x0000000000286000-memory.dmp

    Filesize

    88KB

  • memory/2116-3-0x0000000000270000-0x0000000000286000-memory.dmp

    Filesize

    88KB

  • memory/2116-7-0x00000000000E0000-0x00000000000F0000-memory.dmp

    Filesize

    64KB

  • memory/2116-1-0x0000000000150000-0x0000000000166000-memory.dmp

    Filesize

    88KB

  • memory/2116-14-0x0000000000150000-0x0000000000166000-memory.dmp

    Filesize

    88KB

  • memory/2608-31-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2608-35-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2608-26-0x00000000001B0000-0x00000000001C6000-memory.dmp

    Filesize

    88KB

  • memory/2608-30-0x00000000001B0000-0x00000000001C6000-memory.dmp

    Filesize

    88KB

  • memory/2608-32-0x0000000000100000-0x0000000000110000-memory.dmp

    Filesize

    64KB

  • memory/2724-13-0x00000000000B0000-0x00000000000C6000-memory.dmp

    Filesize

    88KB

  • memory/2724-15-0x0000000000090000-0x00000000000A6000-memory.dmp

    Filesize

    88KB

  • memory/2724-16-0x0000000000180000-0x0000000000190000-memory.dmp

    Filesize

    64KB

  • memory/2724-34-0x0000000000090000-0x00000000000A6000-memory.dmp

    Filesize

    88KB

  • memory/2724-33-0x00000000012E0000-0x0000000001356000-memory.dmp

    Filesize

    472KB

  • memory/2724-9-0x00000000000B0000-0x00000000000C6000-memory.dmp

    Filesize

    88KB

  • memory/2744-18-0x0000000000380000-0x0000000000396000-memory.dmp

    Filesize

    88KB

  • memory/2744-24-0x0000000000160000-0x0000000000170000-memory.dmp

    Filesize

    64KB

  • memory/2744-22-0x0000000000380000-0x0000000000396000-memory.dmp

    Filesize

    88KB

  • memory/2744-23-0x0000000000140000-0x0000000000156000-memory.dmp

    Filesize

    88KB