Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 01:38

General

  • Target

    a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe

  • Size

    316KB

  • MD5

    a36601d1d5377e250316a09ddd944293

  • SHA1

    656b00ae0179cdecbc1b4aa6caa522e564e42022

  • SHA256

    fbc56edfa84eb772836844811d9a28855d88e53095656efd5548b3551fb645be

  • SHA512

    ce6a68058f7c0ebb01a072092e19f24c8657b97ff604ca4a63caea6b88495bc111dd8eab0c27824c1418f68ccfe83b3678dc194b0d48a638723e0247d8dca01b

  • SSDEEP

    6144:br/bUzkuvcBYC47l2xij4YTfpczmap8spMPed0VdtM9BdjhY9:br0kuveY3cY1cia66MGd0Vs9BdNe

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4740
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4836,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
    1⤵
      PID:2792

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Tsu8541AC7E.dll

      Filesize

      269KB

      MD5

      af7ce801c8471c5cd19b366333c153c4

      SHA1

      4267749d020a362edbd25434ad65f98b073581f1

      SHA256

      cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

      SHA512

      88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

    • C:\Users\Admin\AppData\Local\Temp\{DBC4C3DA-90F4-490F-ABE4-D8D60027E12C}\Custom.dll

      Filesize

      91KB

      MD5

      52ffb9f31fcf351bed204ed2fa781954

      SHA1

      7acb17bc45cf6edc71726e59fb8a1d37eca51a55

      SHA256

      eb99eb74c3736102b174d6d7ff9afaa43bab8ad4bccfac53bb4dbb80392aa1d4

      SHA512

      841c2683068522077d6f347c17d59815bf5f94015d6b539f6a3248c00bfb8a56360c2c7b3c8960dbda497e76fb88f8859bb5c1a7f80b24fe03dbf00db187f4b9

    • C:\Users\Admin\AppData\Local\Temp\{DBC4C3DA-90F4-490F-ABE4-D8D60027E12C}\_Setup.dll

      Filesize

      173KB

      MD5

      b040c43d630d3740abefba186f46883b

      SHA1

      c3c498b0cc6d34423780e8285cb3dc998ce1c4a3

      SHA256

      dd6dd4df86f215bea1c5b68cb7677dee75cda6cbbbf39ac040d67c992f6146df

      SHA512

      a3e3305ce4925aee378b1a3ed3e58daa743990fe809ac1b3c90640a2fa53736133a8f16c6e8314b5f243ed1109d24e683142d45f1d502cf3714edd748b3c9f5c