Analysis

  • max time kernel
    130s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 11:35

General

  • Target

    91a33c176c77b292929ddc4071393273_JaffaCakes118.exe

  • Size

    315KB

  • MD5

    91a33c176c77b292929ddc4071393273

  • SHA1

    8951bf4b11942039909e326a3faa780fdd0fe78b

  • SHA256

    1f29c564e4a98ba8da7aae0dc7590ea6e90b987d8307c9455ac42e336f0c171d

  • SHA512

    4430224d03bd0d8bb0ef8141f8bfab7d32f5e77aea9f4dd9bde5cd2846a8019a56806f167c0f18ae27a62088d97d341a7627b716742cf5dd99cbf3cdb08388e3

  • SSDEEP

    6144:ZrvbUzkuvcBYC47l2x0vOppHKip3Hrcgrz/xHWS1JT:ZrkkuveY3oXpHggf4S1V

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91a33c176c77b292929ddc4071393273_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\91a33c176c77b292929ddc4071393273_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TsuC318EA8E.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{C7CFDD0E-DAE6-418A-A361-92C41C2CFFF8}\Custom.dll

    Filesize

    91KB

    MD5

    407bfafd7395419e47ee2fc9b85106d3

    SHA1

    2f39606ab6d015ffc2c454b1f8a65e726b476fa5

    SHA256

    463375d0858a48d2bf307a1b94bd6a87974efb6beddb5985c516bccf9c70f03f

    SHA512

    2fcd8d113a1591ed9f2eb35b6abe4d9b5a70e7ca113809cd0ac2e56f7c25121d13955b58c3545123cc4fa0299349bc01bdd7f30c5b6ab73035e584f2ca6ef193

  • C:\Users\Admin\AppData\Local\Temp\{C7CFDD0E-DAE6-418A-A361-92C41C2CFFF8}\_Setup.dll

    Filesize

    173KB

    MD5

    5f545d05ee49f075bf559a3c3e92abd0

    SHA1

    fa9ab330851d255ae21d37e9b011603422725bad

    SHA256

    64e1ca5baffbb0a892909dbd4b07a54d2ee61d86f1ae80ed962d28796ac966b9

    SHA512

    350add685de7868e30d5b71d5180ec4135688ea7ad67a1eba3125837026bebb86b2fb1ff40d18d99a285c54760fb79b6eb1bfa0f396a334425c7f0aaf48b3ff5