Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02-06-2024 17:26

General

  • Target

    8eda529979d30636fb0fbb45c2da7977_JaffaCakes118.exe

  • Size

    76KB

  • MD5

    8eda529979d30636fb0fbb45c2da7977

  • SHA1

    c8894ae2dc2d6f0225c72a2b19fb283a57f077fe

  • SHA256

    ad9ad8c5e78a1060cddb589a027ed9ac6f8ef8fbaa88862e9269690a4fe49283

  • SHA512

    537a16d8dc253800d5225ee1f41135fe619df6c26491fe203632d385751f57a2aa8da5cd9bd4c6582b2f579751ce245aeea367fe106a90058a332d768982d44c

  • SSDEEP

    768:/7XINhXznVJ8CC1rBXdo0zekXUd3CdPJxB7mNmDZkUKMKZQbFTiKKAZTX:ChT8C+fuioHq1KEFoAF

Malware Config

Signatures

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

  • DiamondFox stealer 1 IoCs
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8eda529979d30636fb0fbb45c2da7977_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8eda529979d30636fb0fbb45c2da7977_JaffaCakes118.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Loads dropped DLL
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1720
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • UAC bypass
      • Windows security bypass
      • Drops file in Drivers directory
      • Drops startup file
      • Executes dropped EXE
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2868
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\Melt.bat
      2⤵
      • Deletes itself
      PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Melt.bat

    Filesize

    161B

    MD5

    2b4ac925d0131af926415461d760ac8e

    SHA1

    edd325b6ac9903f1195b19f1b028a5067193e1cc

    SHA256

    6ae190034e591dae070cf5550514fae731b01ec06d7c379827f9633f85320732

    SHA512

    f669447506687bd5a0a76fbb76f6124f358b1866085c5ac16cfba95199a3c8becbc268a6360af0a04a3fdde0e09ac204d2b7b6a1e1034070360076617aab574d

  • \Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    76KB

    MD5

    8eda529979d30636fb0fbb45c2da7977

    SHA1

    c8894ae2dc2d6f0225c72a2b19fb283a57f077fe

    SHA256

    ad9ad8c5e78a1060cddb589a027ed9ac6f8ef8fbaa88862e9269690a4fe49283

    SHA512

    537a16d8dc253800d5225ee1f41135fe619df6c26491fe203632d385751f57a2aa8da5cd9bd4c6582b2f579751ce245aeea367fe106a90058a332d768982d44c