Analysis

  • max time kernel
    132s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 06:27

General

  • Target

    a432ad77c0d241a74f20ddb7536e30a4_JaffaCakes118.exe

  • Size

    458KB

  • MD5

    a432ad77c0d241a74f20ddb7536e30a4

  • SHA1

    e6d9360699b78596b3e476ab5f04113582b59511

  • SHA256

    04fdd2830d5e1a663c46e525a2e4f1c8e8d6d77e95e5760b814873760f4ff611

  • SHA512

    1e5dcecf0c6720425f3bce5862ff930162fe39f4fb09200f9732679bb410ad3738e88b2c9c3a05d5481de001651d4e9a21529ad4713b92890e33ac9811b4b43f

  • SSDEEP

    12288:uBxI1rcVvaDWXJfnjccDDRrYSQCb9y9ZIox:uArcVv6WXJfj1BYJCpSIox

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a432ad77c0d241a74f20ddb7536e30a4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a432ad77c0d241a74f20ddb7536e30a4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Local\Temp\kxdmmbfacxuvxl\wqswwshjbktnk.exe
      "C:\Users\Admin\AppData\Local\Temp\kxdmmbfacxuvxl\wqswwshjbktnk.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\kxdmmbfacxuvxl\parent.txt

    Filesize

    458KB

    MD5

    a432ad77c0d241a74f20ddb7536e30a4

    SHA1

    e6d9360699b78596b3e476ab5f04113582b59511

    SHA256

    04fdd2830d5e1a663c46e525a2e4f1c8e8d6d77e95e5760b814873760f4ff611

    SHA512

    1e5dcecf0c6720425f3bce5862ff930162fe39f4fb09200f9732679bb410ad3738e88b2c9c3a05d5481de001651d4e9a21529ad4713b92890e33ac9811b4b43f

  • \Users\Admin\AppData\Local\Temp\kxdmmbfacxuvxl\wqswwshjbktnk.exe

    Filesize

    7KB

    MD5

    8a959797410574084227ec6650d7451a

    SHA1

    c63452ad574a9d7819dc8c2ab44c0b89fa052fdc

    SHA256

    c7d142469e8b045d08c7711bc6e3f9548d4879eef1d487568abcf2ea865a8fa1

    SHA512

    3b27ee9a4eaeba3d7b58c8807250a991c93e6dfaea314f4f689967d365b245d09c4cad134dec365141d4e6cee5b8daf5c9fbf41338a4f9a71a7572fcbb3d21e2

  • memory/3000-10-0x000007FEF59EE000-0x000007FEF59EF000-memory.dmp

    Filesize

    4KB

  • memory/3000-11-0x0000000000A90000-0x0000000000AD4000-memory.dmp

    Filesize

    272KB

  • memory/3000-12-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

    Filesize

    9.6MB

  • memory/3000-13-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

    Filesize

    9.6MB

  • memory/3000-20-0x0000000021320000-0x0000000021AC6000-memory.dmp

    Filesize

    7.6MB

  • memory/3000-25-0x000007FEF59EE000-0x000007FEF59EF000-memory.dmp

    Filesize

    4KB

  • memory/3000-26-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

    Filesize

    9.6MB