Analysis

  • max time kernel
    145s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 08:19

General

  • Target

    a8b336554ce53c37d8b06cef70d20ea7_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    a8b336554ce53c37d8b06cef70d20ea7

  • SHA1

    a188091f32a0b43411e079ac80009ca7398bccad

  • SHA256

    3d3d08830d0a221a8a3dd6caf33d5b6ad3c0e4dc61c731f1fd303c5b60b491a6

  • SHA512

    a3b6afe121a4296c66dc8759a922ad99bb4050f7f0e7806478db6bcf8ea79ddf732c1ae87232bade79d0829c226c50f0ba94f759205a2d9f7bd2e019b791cdb4

  • SSDEEP

    24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvE:oEs1hm

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8b336554ce53c37d8b06cef70d20ea7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8b336554ce53c37d8b06cef70d20ea7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:1656
    • C:\Users\Admin\AppData\Local\Temp\Client UrlCache MMF Ver 5.2
      "C:\Users\Admin\AppData\Local\Temp\\Client UrlCache MMF Ver 5.2"
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.exe

    Filesize

    1.1MB

    MD5

    f0f52ee197f71b7fe6adbadcb3160e06

    SHA1

    2d9d49befe4df58d17463054fc6a85f06e431b16

    SHA256

    739b0f366cfe756157c49fe9afbd9a656170ac8ecc346346e51441b1b025d175

    SHA512

    709faa451a0742281aa801992ceee2ba330d70f255ca5f2c40cc23e94aa479c25d5a406bef63bbd7e11568642e6db40dbb17038305f8701246c2e9aba1be7102

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    950B

    MD5

    d6496fe8b68d56b3d2818e2ba67bb29f

    SHA1

    b474530d4d98787b58104858bf5eff39b35d4bd7

    SHA256

    040a877fe88c3f72b9d4b16783d8a07be54280f37cbdbccb6325560ed5fc3432

    SHA512

    25e443200b35dee0d099e90c2fd9efa1469c7ec5baf644ebd3b4c430d30be9f308875cd963a1a02f49600b3d4f9f37ed74091a5daa87472d06ae40ca8848277e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    97413aeb915614565c2a6f9947afdd76

    SHA1

    b7495d425397f67d0fd536a1c7e1d5fe44be8114

    SHA256

    f89b1f8c01ee0efda9c3727bd10af677ed8285e30db9c0d2558a01d85c139f92

    SHA512

    5ba224143be2566b5b381bec340527bd68a3793fd56430e35f58c0008c1a90ddb1ea0e38661986f217e249c698c702ca58201aed286db913ef78bc3a4d8694b9

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • \Users\Admin\AppData\Local\Temp\Client UrlCache MMF Ver 5.2

    Filesize

    1.1MB

    MD5

    a8b336554ce53c37d8b06cef70d20ea7

    SHA1

    a188091f32a0b43411e079ac80009ca7398bccad

    SHA256

    3d3d08830d0a221a8a3dd6caf33d5b6ad3c0e4dc61c731f1fd303c5b60b491a6

    SHA512

    a3b6afe121a4296c66dc8759a922ad99bb4050f7f0e7806478db6bcf8ea79ddf732c1ae87232bade79d0829c226c50f0ba94f759205a2d9f7bd2e019b791cdb4

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    1.1MB

    MD5

    5bd894512a1461986e3bcc6e8115fc01

    SHA1

    094b1452ba2472b9056e0d085c5672c5f228caef

    SHA256

    4582db4d3e503042fbf114517eb69c7e2ed76be2d830f6376698a99bb9721e3f

    SHA512

    4a73dc0b63988ccd03b505e32d81ca9652057b60d138989112798c98aca006a8b524cb0ef46fc9b35fb744d858a7743a34e771eae1c5c8fb6fcf4529f227acc4

  • memory/1640-4-0x0000000001F20000-0x0000000001F97000-memory.dmp

    Filesize

    476KB

  • memory/1640-23-0x0000000001F20000-0x0000000001F97000-memory.dmp

    Filesize

    476KB

  • memory/1640-22-0x0000000001F20000-0x0000000001F97000-memory.dmp

    Filesize

    476KB

  • memory/1640-0-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1640-31-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1640-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/1656-323-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-313-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-382-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-249-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-373-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-13-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1656-255-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-260-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-363-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-351-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-271-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-343-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-279-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-333-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-293-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-11-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1656-303-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-304-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-261-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-314-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-294-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-324-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-284-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-334-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-272-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-344-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-26-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2368-352-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-262-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-364-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-250-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-374-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-24-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2368-383-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB