Analysis

  • max time kernel
    145s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 07:27

General

  • Target

    b7627865ebb11f7512bf13d1aa0deab6_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    b7627865ebb11f7512bf13d1aa0deab6

  • SHA1

    a7ed0db06d85193426dceb71ce7d38988f39420b

  • SHA256

    c68f09f188aeb65d6001571f7882009084ce27ef915b154f781635378b6d0b40

  • SHA512

    fb6d7553dd4a63eaaf3a4fe27f35f8207988b6c5ebdcaa6c8d0135139c3136306c2921d8e237ab0a0710d9d06a31b1880767e8af7ebc7fb401601f4ce5e3edf0

  • SSDEEP

    24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvU:oEs1hi

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7627865ebb11f7512bf13d1aa0deab6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b7627865ebb11f7512bf13d1aa0deab6_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.exe

    Filesize

    1.3MB

    MD5

    082c57bfff321a3aac210289f32e4e45

    SHA1

    d1870bf89682e6e8b8b68e356dbb47b5f54f3f29

    SHA256

    fdac8659f87170090f9a8d0d9848bfe552b3c40c21e52fee42955943cd8e21d6

    SHA512

    4374a61328869888de8c5be8cdf4546ef0de9545c346ee3f25c99dd084c26c552193e4b2464eb8748f6603915db093c65d45e40a2b3945f877c11c34e417fad7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    b32a644b635822ca16a6ed146a8cc4e2

    SHA1

    253863d8a13054f2148b2eebe88d19ed9d4e82a9

    SHA256

    4a0889778f3a75762230f08c17562cb614c92c6161442858f4b7f5dc2ed3de88

    SHA512

    cd67e4a83616e5fccb894b179237d89470095090c39b11880617fb9e6d55fc442f4cdff93bb02ad2ed6e1695cbc8b2a57f04b56448e5bc79e436d0bbb9792380

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    950B

    MD5

    0381112327105cde94231152781be38c

    SHA1

    2446015bf5ddb0c099602b189672307ea9b76207

    SHA256

    6eeb429e294600f6ecdeeea57ae6ffd6aef18b48ed2f69eb2f890259a3d26a3a

    SHA512

    c89ac5b0f907b417eb592c893066af3962164ffd53c255755aa860cee8b56199b9805bbce5d17be1dd49343a67123784a2323c3d1fc4fb35e33fe870023a3754

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    1.3MB

    MD5

    b7627865ebb11f7512bf13d1aa0deab6

    SHA1

    a7ed0db06d85193426dceb71ce7d38988f39420b

    SHA256

    c68f09f188aeb65d6001571f7882009084ce27ef915b154f781635378b6d0b40

    SHA512

    fb6d7553dd4a63eaaf3a4fe27f35f8207988b6c5ebdcaa6c8d0135139c3136306c2921d8e237ab0a0710d9d06a31b1880767e8af7ebc7fb401601f4ce5e3edf0

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    1.3MB

    MD5

    dc07e9ab8f299d656ccb86184b1acfb5

    SHA1

    32c24fb13f1e60d6d2a60fb19fb1ff9477244040

    SHA256

    c16108b15e11821eafdaedfd28c9d5f3f612b656e0a1b9e2e3b10c4f5932a6a3

    SHA512

    4d74294f50a378641e8e8e50413eacb3b54123838be2f4283c91f5db15c1d899fe1899c7afed1c1d8cb6c9cb332bb92dc3b42fd2bfac362b6692bac11181d0e4

  • memory/1636-354-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-332-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-4-0x0000000000380000-0x00000000003F7000-memory.dmp

    Filesize

    476KB

  • memory/1636-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1636-230-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-294-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-240-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-344-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-242-0x0000000000380000-0x00000000003F7000-memory.dmp

    Filesize

    476KB

  • memory/1636-364-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-252-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-324-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-262-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-0-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-274-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-314-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-284-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1636-304-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-263-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-295-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-285-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-305-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-275-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-315-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-325-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-253-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-243-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-333-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-241-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-345-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-231-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-355-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2972-12-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2972-365-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB