Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 01:38

General

  • Target

    a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe

  • Size

    316KB

  • MD5

    a36601d1d5377e250316a09ddd944293

  • SHA1

    656b00ae0179cdecbc1b4aa6caa522e564e42022

  • SHA256

    fbc56edfa84eb772836844811d9a28855d88e53095656efd5548b3551fb645be

  • SHA512

    ce6a68058f7c0ebb01a072092e19f24c8657b97ff604ca4a63caea6b88495bc111dd8eab0c27824c1418f68ccfe83b3678dc194b0d48a638723e0247d8dca01b

  • SSDEEP

    6144:br/bUzkuvcBYC47l2xij4YTfpczmap8spMPed0VdtM9BdjhY9:br0kuveY3cY1cia66MGd0Vs9BdNe

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin3EE2.bat"
      2⤵
        PID:2728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\InstallMate\BD8223CE\cfg\1.ini

      Filesize

      914B

      MD5

      ae30d305b37acc71df1c8df6f6f70099

      SHA1

      474dc75a045fce3b1e28582188cdfc0da1fca220

      SHA256

      44c7c6a21f6de5e97572cb7ced42f63c88d2f8b41ca1fb00a26c69a3944dc3ea

      SHA512

      0c81dba06e36e25968417525a02d1004803832691357e656bf9ffa633f3b6569ea96c5d9925d60d17a2ec7502554a533fa8aa330973dc042e726f86ec64f6c44

    • C:\Users\Admin\AppData\Local\Temp\_tin3EE2.bat

      Filesize

      50B

      MD5

      d757ce2624e744f033ec2602ca64fba1

      SHA1

      524394e8cacb2ebccded57d82fd5dbbf58fb00b9

      SHA256

      394a3463100d983b65e43d24ee17000afdcc3e571dfb22b2bb49cc0925af8f0c

      SHA512

      981cc064e892faf9a7dfac0623f3352219bcf12e1d9350d2c58a3b6e6e1ce1c05ac66ef495a4e141fd90c04c0d171353322ad55cc7b264bbe38e9c2656c4d8c9

    • C:\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Readme.txt

      Filesize

      2KB

      MD5

      2980425cd6aa72d796478da717afe401

      SHA1

      880b0fb1cf65e0ffef74d8ba8302acea30a107c5

      SHA256

      bec01271e5ea03f709355bf734b70fcf5139046dbe3002a5baffcba12fe6632e

      SHA512

      9088c2506560c41277c1ea19d53b67d8a177edda362175a6985afe45e2e7721a8d5c901e2172ceec6d24b5b07610845c8f599a86e2b991f2bc684f2a0b61a8b6

    • C:\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Setup.exe

      Filesize

      15KB

      MD5

      e717f6ce3a7429bfa6d7f3cf66737a4b

      SHA1

      01f4042589b4ed88c351ffeac256be7a9d884818

      SHA256

      7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633

      SHA512

      65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

    • C:\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Setup.ico

      Filesize

      4KB

      MD5

      f77f10074521602a95354d87745569b5

      SHA1

      9a174bd576caaced672891d2df98e150c07d59e5

      SHA256

      117031dbff146e33fdf41527f9d37935418cbff079ad22466d0fd5a7d2895ea3

      SHA512

      a71e1bb898c65b2e78e2aaca0591794f5a75e67580802ff1e5246bbe75389f909f21f14fca7d5faae7b39f54e215c009bc3fe9a2ea774d82600bc406d4e0a7ca

    • \Users\Admin\AppData\Local\Temp\Tsu813DE590.dll

      Filesize

      269KB

      MD5

      af7ce801c8471c5cd19b366333c153c4

      SHA1

      4267749d020a362edbd25434ad65f98b073581f1

      SHA256

      cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

      SHA512

      88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

    • \Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Custom.dll

      Filesize

      91KB

      MD5

      52ffb9f31fcf351bed204ed2fa781954

      SHA1

      7acb17bc45cf6edc71726e59fb8a1d37eca51a55

      SHA256

      eb99eb74c3736102b174d6d7ff9afaa43bab8ad4bccfac53bb4dbb80392aa1d4

      SHA512

      841c2683068522077d6f347c17d59815bf5f94015d6b539f6a3248c00bfb8a56360c2c7b3c8960dbda497e76fb88f8859bb5c1a7f80b24fe03dbf00db187f4b9

    • \Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\_Setup.dll

      Filesize

      173KB

      MD5

      b040c43d630d3740abefba186f46883b

      SHA1

      c3c498b0cc6d34423780e8285cb3dc998ce1c4a3

      SHA256

      dd6dd4df86f215bea1c5b68cb7677dee75cda6cbbbf39ac040d67c992f6146df

      SHA512

      a3e3305ce4925aee378b1a3ed3e58daa743990fe809ac1b3c90640a2fa53736133a8f16c6e8314b5f243ed1109d24e683142d45f1d502cf3714edd748b3c9f5c