Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 03:54

General

  • Target

    9074865fe78f6a0e3a4050c521369e8c_JaffaCakes118.exe

  • Size

    913KB

  • MD5

    9074865fe78f6a0e3a4050c521369e8c

  • SHA1

    5f30223096f57757bc02182fa3247caeccd1e36b

  • SHA256

    a79c14ac76eb143b25f9e5211570da7348de79180e17dacbd4fcd3fac7ff6a63

  • SHA512

    d231fa8890691bf2ccb1acbb07301a4eae5c3d55396420c7ff4601ac3d367b29d2ab36f5482e6db1d210f29c03934d219fe709b7cde0fa3c9d27d6fd3977182c

  • SSDEEP

    24576:H0Qi1ZDezSQzIGCOKb3Aih50eaQU5mHIRsUTSejHzPoeeMc34p8345jNpZvon22W:Un1IOQzIGCOKb3Aih50eaQU5mHIRsUTZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9074865fe78f6a0e3a4050c521369e8c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9074865fe78f6a0e3a4050c521369e8c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\9074865fe78f6a0e3a4050c521369e8c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9074865fe78f6a0e3a4050c521369e8c_JaffaCakes118.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Users\Admin\AppData\Local\Temp\9074865fe78f6a0e3a4050c521369e8c_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\9074865fe78f6a0e3a4050c521369e8c_JaffaCakes118.exe"
        3⤵
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\drp1gaJUkIF0IBN\1ImWMsNOdyfE.dll

    Filesize

    76KB

    MD5

    8d846381b5d810516eae3e524e642cf3

    SHA1

    63625f701ee3a41ff9c254fcf76fc1b23a8d4ee1

    SHA256

    93f22e354bd43ff42c88fa83f1ddc2ba2cd68624a948cd94c86a0a15c0167b71

    SHA512

    7a38f6eac6fa7a26919795dd5d57f474ed8b9de32b8304896000237a11cf9ebf8a935f732ede830d4fd71cd30514a9fcf9271352e9b0b271509d8f12be54f1e7

  • \Users\Admin\AppData\Local\Temp\drp1gaJUkIF0IBN\2Cozk98.dll

    Filesize

    202KB

    MD5

    7160ebc558a797f0dae8e1a4b24ed184

    SHA1

    1a08fd01e298d949ad93109fbc4870a28cfe6660

    SHA256

    cc19c4d2c90fb690db678846bc5545c134e0eca10a2d75cce1bb4f49c3428ef4

    SHA512

    b1a44e50f30f74fe75fddf9643368dbb22bfabbb1a72b710c8242d177fda4e0327f069ac3fa2bbb92ffe8554dd72509121336d316a272672d25e480e25692826

  • \Users\Admin\AppData\Local\Temp\drp1gaJUkIF0IBN\UugHSsEez1SsaBz1bCz1Ttz1fGhI67jKCc.dll

    Filesize

    5KB

    MD5

    44dac7f87bdf94d553f8d2cf073d605d

    SHA1

    21bf5d714b9fcab32ba40ff7d36e48c378b67a06

    SHA256

    0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

    SHA512

    92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

  • \Users\Admin\AppData\Local\Temp\drp1gaJUkIF0IBN\lua51.dll

    Filesize

    494KB

    MD5

    f0c59526f8186eadaf2171b8fd2967c1

    SHA1

    8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

    SHA256

    6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

    SHA512

    dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

  • memory/2016-18-0x000000007EF90000-0x000000007EFA0000-memory.dmp

    Filesize

    64KB

  • memory/2016-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2016-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2016-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2016-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2016-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2016-10-0x00000000002A0000-0x00000000002D7000-memory.dmp

    Filesize

    220KB

  • memory/2016-14-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

    Filesize

    64KB

  • memory/2016-5-0x0000000000250000-0x0000000000267000-memory.dmp

    Filesize

    92KB

  • memory/2016-23-0x000000007EF80000-0x000000007EF90000-memory.dmp

    Filesize

    64KB

  • memory/2016-27-0x000000007EF80000-0x000000007EF90000-memory.dmp

    Filesize

    64KB

  • memory/2016-26-0x000000007EF80000-0x000000007EF90000-memory.dmp

    Filesize

    64KB

  • memory/2016-25-0x000000007EF80000-0x000000007EF90000-memory.dmp

    Filesize

    64KB

  • memory/2016-24-0x000000007EF80000-0x000000007EF90000-memory.dmp

    Filesize

    64KB

  • memory/2016-28-0x000000007EF80000-0x000000007EF90000-memory.dmp

    Filesize

    64KB

  • memory/2016-29-0x000000007EF80000-0x000000007EF90000-memory.dmp

    Filesize

    64KB