Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 21:35

General

  • Target

    9c01f9073e1c7ed49294f7bb920e190f_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    9c01f9073e1c7ed49294f7bb920e190f

  • SHA1

    567b24cf5aa7e294c402b036efebee8a56e60819

  • SHA256

    80ca7afd6ed54c58ae7bf224fdcc7bd9a31ee5706598997de0d3219b0f5680d0

  • SHA512

    9498dc73bc8bfc86270812c2e542658cff5c6cc3e813764dcd6924d5b27abf65e104c0ce24ae527065c5d736df389010fa23a27df9a9896296d7ceea58ea3579

  • SSDEEP

    768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHGg:aqk/Zdic/qjh8w19JDHN

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c01f9073e1c7ed49294f7bb920e190f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9c01f9073e1c7ed49294f7bb920e190f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2444

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpA6C.tmp

          Filesize

          40KB

          MD5

          ac8f926d5411da6c71aa9fd590fc873e

          SHA1

          4e569bc3ce6d2fcb345597255ba524420bfcc16f

          SHA256

          4a86239cd7ef5507b4dd917f9680a7338931c3e07d74ed0c0d8d75a7845fbeca

          SHA512

          04a0c7f0b35994a610d9496e97b2f918d6a182267a5e3601e1f90b907bfb4397ca2e5a06e114ee9392ec9c71dbb0a4f5b0cdcf50fe7da27184569572bffe25a9

        • C:\Users\Admin\AppData\Local\Temp\zincite.log

          Filesize

          1KB

          MD5

          f63ab5030060312bf48a37465a7110f0

          SHA1

          4ef4127df673a3c12d38a506a1fa89a04fc06754

          SHA256

          6c0db8afa0a5c3886ed26a21f602c49e19ed84f45ed586870aa87075ce5abfa6

          SHA512

          46792bb3cbfb0fd2b283e7b16f95ea621304565caf66490193b1c8c4e5a93072528a0408491f6977168bdf6ec45c7041e97bf78543838f6f0fd7d42b34f03287

        • C:\Windows\services.exe

          Filesize

          8KB

          MD5

          b0fe74719b1b647e2056641931907f4a

          SHA1

          e858c206d2d1542a79936cb00d85da853bfc95e2

          SHA256

          bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

          SHA512

          9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

        • memory/992-22-0x00000000001B0000-0x00000000001B8000-memory.dmp

          Filesize

          32KB

        • memory/992-10-0x00000000001B0000-0x00000000001B8000-memory.dmp

          Filesize

          32KB

        • memory/992-9-0x00000000001B0000-0x00000000001B8000-memory.dmp

          Filesize

          32KB

        • memory/992-0-0x0000000000500000-0x000000000050D000-memory.dmp

          Filesize

          52KB

        • memory/992-23-0x00000000001B0000-0x00000000001B8000-memory.dmp

          Filesize

          32KB

        • memory/2444-32-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-45-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-28-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-21-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-36-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-37-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-41-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-27-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-46-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-50-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-54-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-17-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-11-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-61-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB

        • memory/2444-64-0x0000000000400000-0x0000000000408000-memory.dmp

          Filesize

          32KB