Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 10:14

General

  • Target

    a5079d2183bdf000710a2f4edcfdf3f8_JaffaCakes118.exe

  • Size

    339KB

  • MD5

    a5079d2183bdf000710a2f4edcfdf3f8

  • SHA1

    30b0878b0285627b19213857764b15e0fc93ac62

  • SHA256

    34b6799f07c656918d96639d13b299b26ee7b592629d217438eff8b4b277d1fb

  • SHA512

    9f4adcafb379c4a9020f3e8fc00f532913f99e47429c512b3787bd4fbba67bbb3335ffd31a475c98e833d169681798f4d1594b01c22ee594e965a5b0ecb36872

  • SSDEEP

    3072:XT0d08AmyS59HEjD7sgFX7VdlT+FwKd7Z6EOJRY/nddAAWJZSoB+TrV6dDz6uQBe:jW559ybrVnqoc1WJZSo48d6vBraCrs

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 6 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5079d2183bdf000710a2f4edcfdf3f8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a5079d2183bdf000710a2f4edcfdf3f8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:376
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {FB3610A5-217B-46D0-BEEE-057FF1FC40AD} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\ProgramData\ghbamjdm\bfjnednc.dhf",DllGetClassObject host
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\ProgramData\ghbamjdm\bfjnednc.dhf",DllGetClassObject host
        3⤵
        • Blocklisted process makes network request
        • Deletes itself
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious behavior: RenamesItself
        • Suspicious use of SetWindowsHookEx
        PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\ghbamjdm\0d0240c254ca

    Filesize

    1KB

    MD5

    5b76b3f86d0e1f3f397c9f5cf4e2ae3c

    SHA1

    8acac8e96af0c85efa46a117efa028002dc53403

    SHA256

    84af7190bb4943e9acf8cc7acd64c54091c13195de7995f3ca1445054d4dbdec

    SHA512

    344e4a8da4e222cb78e1d3dd67835c3d5473a2d93b3cfec32ee1304ffa47ba17eeb5939bc8fe36e9da9d5034daa8d7a167442759340c0a61bc9e5978533d9900

  • C:\Users\Admin\AppData\Local\Temp\27DB.tmp

    Filesize

    212KB

    MD5

    9a359c7a57a9af742c9e0aa59c047cfb

    SHA1

    017d90de87eab0b0c5b73e6eacbb5b637440d7f1

    SHA256

    309a1ec1fa3fbd4ecdfb2301df0991e43137f4bb8a57fd4831ac343d7f780bd5

    SHA512

    79b589508baa24b0078ef9ada55c887b97d02430d4c14533193150ba5e1335527c3b898063848d65c6038cb63e87ee2bd7d9678d75a35a5b3e79af78a7429acb

  • \Users\Admin\AppData\Local\Temp\27DB.tmp

    Filesize

    212KB

    MD5

    0f09bcd355ac453606e8a2e953cd7c1e

    SHA1

    942cf739cca27ed8fd28d4b2c153033ffaa48e77

    SHA256

    8843a2a66395fa409c66beacc3d2b928e2195a12827450f2d6381bfdf51595d0

    SHA512

    e187f068f8beb7b2d1a53222a290a02033a0806ae48479f8fc666e7578c6fd3e7e61cd3fb1748c61c42a2750e964731c4dc84e679da599122c63e8c7e9c550fc

  • memory/376-9-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/376-17-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/376-7-0x0000000000560000-0x00000000005C9000-memory.dmp

    Filesize

    420KB

  • memory/376-8-0x0000000000560000-0x00000000005C9000-memory.dmp

    Filesize

    420KB

  • memory/376-10-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/376-0-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/376-16-0x0000000000560000-0x00000000005C9000-memory.dmp

    Filesize

    420KB

  • memory/376-5-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/376-1-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/376-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2768-22-0x00000000026A0000-0x00000000026A1000-memory.dmp

    Filesize

    4KB

  • memory/2768-21-0x0000000000740000-0x00000000007A9000-memory.dmp

    Filesize

    420KB

  • memory/2768-20-0x0000000000740000-0x00000000007A9000-memory.dmp

    Filesize

    420KB

  • memory/2768-34-0x0000000000740000-0x00000000007A9000-memory.dmp

    Filesize

    420KB

  • memory/2768-35-0x0000000000740000-0x00000000007A9000-memory.dmp

    Filesize

    420KB

  • memory/2768-37-0x0000000000740000-0x00000000007A9000-memory.dmp

    Filesize

    420KB