Analysis

  • max time kernel
    144s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2024, 19:16

General

  • Target

    aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe

  • Size

    21.1MB

  • MD5

    aff24f3d5b86c1a8592b38b609350c54

  • SHA1

    3f28f02e948095e8e3f3a2abd3328fbc281ea7b7

  • SHA256

    d79db4c19cb70ffec4ac9c75564a51069fea23a8839d3f0267eae20d9ee1f9e4

  • SHA512

    dd390400957bad58621f67184924e6bf6764f393121da705c08d7e7b9bf573169b2697dc840dd26b96fc45ded24d687eda6c833e5e68edccd3d24c6d7dc92065

  • SSDEEP

    393216:5VjSEPbi7v4SUJIS7kqyOOmUa07h9FI+gB0hLuhu4D3f/s2dXhMEv:zdy4PIS7kHdaiLFGg4D3f/sov

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1939202 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-39690363-730359138-1046745555-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

    Filesize

    1.3MB

    MD5

    9bdcf813d65265255b820bc7a704da3c

    SHA1

    dad6501711992ab874d778ece5a103e143fd42d7

    SHA256

    b15d67b4a57184e5202df3c25e20dc0b7f853f4d527d148b337138900989824a

    SHA512

    53cac68a57194ec33ccc5c212a6b82bc554e85c86faab4e095876f5c037f680c646ce8463857e61438b92cb7ca7c17efea1d713a9d772d9f2afeb5ddd17b6504

  • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

    Filesize

    322KB

    MD5

    c3f5f4a1fb69b5889f0bbb313cf6017f

    SHA1

    e4f592cfbd62a3c3caf27177ccea5a77afa649bb

    SHA256

    769416fa7edf38e91a55f4f7163914ee4aad9c8c890ed641c300b73157acac45

    SHA512

    e17d3be36fd2ba892d945f3737ebffdefe6d476224ef3459b567579971559a048a886941f57ae671b3df32844f99575a14c72ef8c49c2d4b1e8352204ccc05ab

  • memory/2752-5-0x0000000002930000-0x0000000002D17000-memory.dmp

    Filesize

    3.9MB

  • memory/2752-18-0x0000000002930000-0x0000000002D17000-memory.dmp

    Filesize

    3.9MB

  • memory/2752-23-0x0000000002930000-0x0000000002D17000-memory.dmp

    Filesize

    3.9MB

  • memory/2752-35-0x0000000002930000-0x0000000002D17000-memory.dmp

    Filesize

    3.9MB

  • memory/3036-29-0x00000000010B0000-0x0000000001497000-memory.dmp

    Filesize

    3.9MB

  • memory/3036-33-0x00000000010B0000-0x0000000001497000-memory.dmp

    Filesize

    3.9MB