Overview

overview

7

Static

static

3

a765f9fed4...18.exe

windows7-x64

7

a765f9fed4...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 00:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a765f9fed495b204efda902352258ca1_JaffaCakes118.exe
  • Size 313KB
  • Sample240614-a7ldtaybpd
  • SHA256 8610e129d79eef12a6e7b368bbefa59808096c925b6d72b3ef5aeaa7defa0ff0
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a765f9fed495b204efda902352258ca1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a765f9fed495b204efda902352258ca1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinFD4D.bat"
      2⤵
        PID:2732

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          1.ini
          • Path C:\ProgramData\InstallMate\D295194F\cfg\1.ini
          • Size 912B
          • SHA256 f87b754792e139a308421fac371cda913f0fc30755083899b9731775ef6c417f
          • MD5 SHA1 SHA512
          Submit Download

          Tsu08619D3B.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Tsu08619D3B.dll
          • Size 269KB
          • SHA256 cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _tinFD4D.bat
          • Path C:\Users\Admin\AppData\Local\Temp\_tinFD4D.bat
          • Size 50B
          • SHA256 597fdd2a4995dc65bc1ef23201d2dc23d48ea92db52ff3eb034323d4ea8e4e24
          • MD5 SHA1 SHA512
          Submit Download

          Custom.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{DCDBF899-321A-41F2-A319-7A380738DA6F}\Custom.dll
          • Size 91KB
          • SHA256 c568abf39b7c7be25a72e3ccb846a055ada002fa382c3431fd4fc8f755c42568
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Readme.txt
          • Path C:\Users\Admin\AppData\Local\Temp\{DCDBF899-321A-41F2-A319-7A380738DA6F}\Readme.txt
          • Size 2KB
          • SHA256 90f8c7a08c6228beb511920bbe1575e9bd4a2b8295e0192d790057d3165dfbc5
          • MD5 SHA1 SHA512
          Submit Download

          Setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\{DCDBF899-321A-41F2-A319-7A380738DA6F}\Setup.exe
          • Size 15KB
          • SHA256 7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Setup.ico
          • Path C:\Users\Admin\AppData\Local\Temp\{DCDBF899-321A-41F2-A319-7A380738DA6F}\Setup.ico
          • Size 4KB
          • SHA256 ef9efd67ea5e382f6e865cfd6f2c0bd11c2d8434162abcd2f61c2fad5c67e66b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _Setup.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{DCDBF899-321A-41F2-A319-7A380738DA6F}\_Setup.dll
          • Size 169KB
          • SHA256 cecd634e90c0908eca56369fa102009e35a2bd82617c2cb09bcf17f6b2c45337
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download