Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02-06-2024 20:49

General

  • Target

    8f604408532bc298c12de77e77d67652_JaffaCakes118.exe

  • Size

    14.3MB

  • MD5

    8f604408532bc298c12de77e77d67652

  • SHA1

    b16d5cae22bd5af1919c107ff5c5786a1a8dfdf0

  • SHA256

    354bf7f1899b9c1eec5cd0f24b75520ef811c12f22ad5e66ce595efcd26aea07

  • SHA512

    cb0f3e11060630afd3ac597385652706fac40e683ddf0d4c2328dd2bc267e8e5f8426d1ea744e70f062e9a9ca489311735deca78394d312381b5136a5838d9fc

  • SSDEEP

    393216:QoS9aM6LJYmNPViSfX88SEy0hme/RZkjX87EQiL7xZr7SWWjIj7:QoS976LJYOPA4X887vhnESmnreW77

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f604408532bc298c12de77e77d67652_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8f604408532bc298c12de77e77d67652_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Roaming\1337\Ex.exe
      "C:\Users\Admin\AppData\Roaming\1337\Ex.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c echo pUVyOKPt
        3⤵
          PID:2860
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c mkdir C:\Users\Admin\AppData\Roaming\Sysfiles & cmd < XuGJAWtEjFqgoZUl.com
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Windows\SysWOW64\cmd.exe
            cmd
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Windows\SysWOW64\PING.EXE
              ping -n 1 moLu.nnnbID
              5⤵
              • Runs ping.exe
              PID:2804
            • C:\Windows\SysWOW64\certutil.exe
              certutil -decode qTh.com y
              5⤵
                PID:2636
              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\csrss.com
                csrss.com y
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2736
                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\csrss.com
                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\csrss.com y
                  6⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2544
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    7⤵
                      PID:1644
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 30
                  5⤵
                  • Runs ping.exe
                  PID:2500
          • C:\Users\Admin\AppData\Roaming\1337\ExtrimHack [free][22.08.2020].exe
            "C:\Users\Admin\AppData\Roaming\1337\ExtrimHack [free][22.08.2020].exe"
            2⤵
            • Executes dropped EXE
            PID:2640

        Network

        • flag-us
          DNS
          moLu.nnnbID
          PING.EXE
          Remote address:
          8.8.8.8:53
          Request
          moLu.nnnbID
          IN A
          Response
        • flag-us
          DNS
          chpMHpkOfJY.chpMHpkOfJY
          csrss.com
          Remote address:
          8.8.8.8:53
          Request
          chpMHpkOfJY.chpMHpkOfJY
          IN A
          Response
        No results found
        • 8.8.8.8:53
          moLu.nnnbID
          dns
          PING.EXE
          57 B
          132 B
          1
          1

          DNS Request

          moLu.nnnbID

        • 8.8.8.8:53
          chpMHpkOfJY.chpMHpkOfJY
          dns
          csrss.com
          69 B
          144 B
          1
          1

          DNS Request

          chpMHpkOfJY.chpMHpkOfJY

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EWSiFeMZzkUETFRYRVL.com

          Filesize

          921KB

          MD5

          c317736793ef5129f12a3568cd679422

          SHA1

          e68b55969c5f2159c847a629fac3731c0c315d53

          SHA256

          cbb5d906c63cbcb891b35e53156b643ac26c5dec922f43b2fd121ccca60beb62

          SHA512

          69cb5fd5f1a30c3c786ca945b8de6a460d03605fc3416a3c33e69691603e1a43ad0cfefe9cd5d6af1a154b701ecf34526cc05d9235a4e38acf994eb0edb1a82c

        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\XuGJAWtEjFqgoZUl.com

          Filesize

          398B

          MD5

          0047726ce0f38e02fda2068d7ff7ceff

          SHA1

          0702fd3e290b95b70b5fc3b70cdb57c808baceb7

          SHA256

          0423e080422306752ccf52e4639a8f6e58596176e730d10bd812012ccf4f296b

          SHA512

          00b525c341b3297e3b011065b32bab9d29eee920e7faebea93e4fcc4fef69b166c11c10291cc9ba9b931551eca3dc9ddae27b681c4d4423478ea3a65d29c7d83

        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ZcaqngYeMJ.com

          Filesize

          2.3MB

          MD5

          09cc8b02108c2ca6db6197e37b165a65

          SHA1

          9f245c5206ce171cfc288ed8bf05896d1b36a1f0

          SHA256

          89ad1822d2ee2d5e39d2e4aae2016562244f7ea43071c192e8989a3c2544d998

          SHA512

          d50c20b554dd85996f8b7432fb3d3668c3fbfcd77314a4adc476861373a0350b122be61ab1aa087153e45c48cf6a453d0829ccfa4786cf679ee3dccb7cffadae

        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\qTh.com

          Filesize

          1.1MB

          MD5

          13a508782d30a527e997a64996920287

          SHA1

          4628a103700d13b6f3920b3a8a06e9757bf0a9eb

          SHA256

          e06ad6278f8cdccb51ed58aee3d6ba97bd770b2d8b827746e539770fc959354e

          SHA512

          cd860c7c8eea0faf0e62f1e695f60c02050c284617265f3e9c11dac4e4cbea34cb656719ae6bdeb39a36dd1446bb443cbcf9c9f4a595c1749f9088d7c082d142

        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\y

          Filesize

          842KB

          MD5

          dbcc4336d132df084c59bbddff9693f5

          SHA1

          172d404379f6d288db4eacaa11bf0fa1ccffa451

          SHA256

          ea3b51ae7fb4264cd4aca28f02fa027bb25ce69a9ece5ff1f9f581b1ae62c84e

          SHA512

          d7209e47c9ef7e8f0db4bc736828e79d745415dde0dbaa7b4d5a21d6ee3406b139f3565cdcae16911c330d3ebbe1bcbe77f5e40d2313909a3b7b58697d3d4e34

        • C:\Users\Admin\AppData\Roaming\1337\ExtrimHack [free][22.08.2020].exe

          Filesize

          11.3MB

          MD5

          fe3a88a304364f9c854c512de19a4e94

          SHA1

          987b853451fa2f61b752e47ab96f3e9de8340d41

          SHA256

          b092117610e94505469547b4297da5dc4ed48af078dae45515a4d9fc211c541b

          SHA512

          f88008b5ab5ec1016314bf67e99ba166522546709029f9fec2477e9b2604cc0a32829c046de5104c1ac4ec89bb3e141ed528c74e6d8a8190baf95272ac223396

        • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\csrss.com

          Filesize

          921KB

          MD5

          8ed172328f643375ac09b31ffba0eb63

          SHA1

          c6716e5e5a311f597e37c5660b0387ab8f77b2a0

          SHA256

          23e87924005aeef08ab3c9402aa749c0373ed9fa6c1706c13ca1df5ec33f8928

          SHA512

          79efbac3cbf2bbbf1b5572a3036845fd544210a01adf9850d22587df12fd84832e14e8f7e0476955a8d9bb42ff0be5ca4443cee8e83dc396e70d850e31c60938

        • \Users\Admin\AppData\Local\Temp\nsi2E14.tmp\System.dll

          Filesize

          11KB

          MD5

          2ae993a2ffec0c137eb51c8832691bcb

          SHA1

          98e0b37b7c14890f8a599f35678af5e9435906e1

          SHA256

          681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

          SHA512

          2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

        • \Users\Admin\AppData\Roaming\1337\Ex.exe

          Filesize

          3.1MB

          MD5

          7afcb8667f1ec33f0cc084936a8a4044

          SHA1

          a2755123f3515fbfcbd5b1ab38c22fa757b8afa8

          SHA256

          2304cf3b3d0753318d60c2769c535a164d5f56ee0343c59ac616036d95e8ad71

          SHA512

          bc04b81c01df03b360c225709d2db3078d1fb45fc2a67713f5f5154d050c71e241c2c7590f510d9f7ac3a0a4bc820b3b171d96cb56d23c0496df184e527162b8

        • memory/1644-99-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-87-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-81-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-78-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-76-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-74-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-72-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-71-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-69-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-67-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-65-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-63-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-60-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-58-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-57-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-56-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-53-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-125-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-122-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-118-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-52-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-115-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-112-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-110-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-107-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-51-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-104-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-48-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-97-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-94-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-91-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-62-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-50-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-83-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-80-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-49-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-77-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-75-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-73-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-70-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-68-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-66-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-64-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-127-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-61-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-59-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-55-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-54-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-124-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-121-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-119-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-116-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-114-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-109-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-106-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-103-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-100-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-96-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-93-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-90-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-88-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-85-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-82-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        • memory/1644-79-0x0000000000510000-0x0000000001510000-memory.dmp

          Filesize

          16.0MB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.