Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 10:14

General

  • Target

    a5079d2183bdf000710a2f4edcfdf3f8_JaffaCakes118.exe

  • Size

    339KB

  • MD5

    a5079d2183bdf000710a2f4edcfdf3f8

  • SHA1

    30b0878b0285627b19213857764b15e0fc93ac62

  • SHA256

    34b6799f07c656918d96639d13b299b26ee7b592629d217438eff8b4b277d1fb

  • SHA512

    9f4adcafb379c4a9020f3e8fc00f532913f99e47429c512b3787bd4fbba67bbb3335ffd31a475c98e833d169681798f4d1594b01c22ee594e965a5b0ecb36872

  • SSDEEP

    3072:XT0d08AmyS59HEjD7sgFX7VdlT+FwKd7Z6EOJRY/nddAAWJZSoB+TrV6dDz6uQBe:jW559ybrVnqoc1WJZSo48d6vBraCrs

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Unexpected DNS network traffic destination 6 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5079d2183bdf000710a2f4edcfdf3f8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a5079d2183bdf000710a2f4edcfdf3f8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:868
  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\ProgramData\bnbcifpe\gjglalel.kfj",DllGetClassObject host
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\ProgramData\bnbcifpe\gjglalel.kfj",DllGetClassObject host
      2⤵
      • Blocklisted process makes network request
      • Deletes itself
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\bnbcifpe\f96874fcb6f5

    Filesize

    1KB

    MD5

    b53babc887877ce234cbe7f47ac11ebf

    SHA1

    287ebfbc09d4e7b0d26c7b0d463ff3d3385279e5

    SHA256

    c43f8c0a671c3d87d81cbba8edc57fa728bfd68897739de491d2fedacc202f9e

    SHA512

    eb845fc70900050d6182a7b295a2022b89d07819bc797c97ebdfc4dfb52dd9e2dedd6b84be9b7e475a3e1254f29c99cac46ae1dad7833bd3d2c4fb4ac5f87103

  • C:\Users\Admin\AppData\Local\Temp\50FE.tmp

    Filesize

    212KB

    MD5

    df832baef4c9a62a43fa19bac03ea73f

    SHA1

    1585e964afcc4ce759339c6f9cc6f5e3908f3bdc

    SHA256

    e011cf5a1c3fa9ce3f192ef87247a14465b419f02cbebf342af661de66a6a33e

    SHA512

    74c593819860f1ab87a85a9a8b9efc6045179760ef781790583383413004ca069d8f6aa185275c0e4618dc44a24b1ab45624b5c3b601e233999bf8ea1e14e839

  • C:\Users\Admin\AppData\Local\Temp\50FE.tmp

    Filesize

    212KB

    MD5

    0f09bcd355ac453606e8a2e953cd7c1e

    SHA1

    942cf739cca27ed8fd28d4b2c153033ffaa48e77

    SHA256

    8843a2a66395fa409c66beacc3d2b928e2195a12827450f2d6381bfdf51595d0

    SHA512

    e187f068f8beb7b2d1a53222a290a02033a0806ae48479f8fc666e7578c6fd3e7e61cd3fb1748c61c42a2750e964731c4dc84e679da599122c63e8c7e9c550fc

  • memory/456-23-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

  • memory/456-46-0x0000000000AE0000-0x0000000000B49000-memory.dmp

    Filesize

    420KB

  • memory/456-40-0x0000000000AE0000-0x0000000000B49000-memory.dmp

    Filesize

    420KB

  • memory/456-38-0x0000000000AE0000-0x0000000000B49000-memory.dmp

    Filesize

    420KB

  • memory/456-39-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

  • memory/456-37-0x0000000000AE0000-0x0000000000B49000-memory.dmp

    Filesize

    420KB

  • memory/456-24-0x0000000000AE0000-0x0000000000B49000-memory.dmp

    Filesize

    420KB

  • memory/456-25-0x0000000000AE0000-0x0000000000B49000-memory.dmp

    Filesize

    420KB

  • memory/868-10-0x00000000020B0000-0x0000000002119000-memory.dmp

    Filesize

    420KB

  • memory/868-20-0x00000000020B0000-0x0000000002119000-memory.dmp

    Filesize

    420KB

  • memory/868-19-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/868-12-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/868-13-0x0000000002120000-0x0000000002121000-memory.dmp

    Filesize

    4KB

  • memory/868-11-0x00000000020B0000-0x0000000002119000-memory.dmp

    Filesize

    420KB

  • memory/868-0-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/868-4-0x0000000002060000-0x0000000002061000-memory.dmp

    Filesize

    4KB

  • memory/868-2-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/868-1-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB