Analysis

  • max time kernel
    145s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 13:50

General

  • Target

    a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    a0e2d36c6dc3a660509580a4c43cfd34

  • SHA1

    124d896477e98621ddcba0d75120016091fc866b

  • SHA256

    a1b7b3c80c80febd8d6b1358cba8492a540234215a2bfbe0dc7d49683e6fac44

  • SHA512

    ddcc10920dd7c2c90b1d0ec653158f324d74b70be9970d50283186bbadbfbb7b80876040cb32cc9db2ac70be54848058e196607a1ee522d7920771a63f681664

  • SSDEEP

    24576:KEtl9mRda1ISGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvb:BEs1lp1tRaMMMMM2MMMMMS5W/j

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      PID:3800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.exe

    Filesize

    901KB

    MD5

    d4cc100663b30789283fa13a9440f286

    SHA1

    9116ceb8225e3b302e67b4c27eba2ef703b634e1

    SHA256

    af1298703a74412a6d8a3daf701a70c4448ec1b26d5ca3ebd426979e53e3640e

    SHA512

    6dcc0e7b0bd66be3a61dc08423613dc9a8b6b4a00de9b7371a07bfc5ed5fd8de1077c34728cbf6fc05021a98c8a154324f9a8c7b9b24e30afd745cd38b5631fe

  • C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe

    Filesize

    1.8MB

    MD5

    2d5577ed73a5549c17ad9cf96874da98

    SHA1

    86f5f257e07f30434a93d2a5ba8f3796a2473f61

    SHA256

    4b3d7e2c90834f6214da7698e33a0a69459e0a57d3a3acf6796481e762f128de

    SHA512

    1c0476d5ef4038108e7aec69100e9cfba0400a2817b838b17b07d08bed8feac35e257230b5ce5f3b5d97298592b867a0a31c8ce701fcc170b1af8f6af7ea4620

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    901KB

    MD5

    96c6cd4e81790949780f17a02975e2d0

    SHA1

    c8090a2cc130d772dbf88f6f1bc3bd19eba5a2ec

    SHA256

    0b09876b0b50fb10766ad32c2c13bac101f59c58c347a80459ef8aff86e84aa2

    SHA512

    664cd14591a39635661f1b16e11ef0f98f6430e689ac1e2e3ff057c8706512f7cf6ac6137c7b074cfaeacce3a162c797b1845cfc90ffd3777c1127af49ce5abd

  • C:\Windows\SysWOW64\notepad.exe.exe

    Filesize

    1.2MB

    MD5

    b099c2d686015e14bd2d0b8dbb598e82

    SHA1

    316dbd9cc287d22eeb93984797bedda73ad761b3

    SHA256

    a7ad9c7de2f56fb627cb947673f2996cfe4dcba9e36ea6bff85a8b4539c81b8f

    SHA512

    f9674f4ebaa3c5304492dc305e3a648f65499c411c65d010cd1f0b2b8cdc2f634b9a0b5c972664243f9223821e0f34b007699d43fdd4827e329b555ce4633f10

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • memory/3800-6-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB

  • memory/3800-68-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3800-69-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB

  • memory/3856-0-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/3856-1-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB

  • memory/3856-19-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB