Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/06/2024, 20:04

General

  • Target

    00422fe3b81b84ef4ea5e7b50edd3ded_JaffaCakes118.exe

  • Size

    208KB

  • MD5

    00422fe3b81b84ef4ea5e7b50edd3ded

  • SHA1

    4b538384c6be15fc4aaa66e0effb4a26444b3653

  • SHA256

    3ed37759dba4df352d1bb6beb0dc9ba414205beb76d7216ef68de4b27c392c25

  • SHA512

    f1e9c3147c3246b90cecc1213afaff3478dda90385acfb67e4a0427dc3eab5d9ee8ceeb207c212f138ee398e98a342b5ef733a42947aea406748d6473e95b512

  • SSDEEP

    3072:jDMM1FSD4979aAqvxpDWDhQx9AhHp8NeqxEN1yy8p+uxb/:j5FfoA8pDqQx9AhJSRxiJ8jt/

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00422fe3b81b84ef4ea5e7b50edd3ded_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\00422fe3b81b84ef4ea5e7b50edd3ded_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\yqtow.exe
      "C:\Users\Admin\yqtow.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\yqtow.exe

    Filesize

    208KB

    MD5

    6f869d73e1364f9b6d331b304d488b57

    SHA1

    d6516bdf3a668e70ba20e9d9c3bc16458d5659a4

    SHA256

    898a2c8cd83c561b2135f089a85979a3d19df357266fa824136b05e1e01e6615

    SHA512

    d157e8e63a66dad67fc269709aad0312260e9d5a14310503e51c35a3679cec4ee71c198629654b3cccc5633f6f60c44ef6f93ffa7ef71d4cf34ebaa37a7e433a