cd403b5283c695722f8197c1b749949d82c986842ebe06c4dbba838e1433339b

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b2689119c8d9cf1428d0e9077a6a48_JaffaCakes118.exe
Size

233KB
MD5

05b2689119c8d9cf1428d0e9077a6a48
SHA1

c231d46a81bbf94aa4dfa638111d291793d33f7b
SHA256

cd403b5283c695722f8197c1b749949d82c986842ebe06c4dbba838e1433339b
SHA512

ead14d0b5a261984e1d23f32237063b6f5caa9cff1892403798a2520025d267dc2f5a0013db13132bf82b82a07330b03286802da1ec93dfcdcd6abf159e58984
SSDEEP

6144:8N7l7ZgJTFLkHEUVlHYvU1kwbuw3YZAV58P6msN+n/MZ:2gJpTUVlHY0kwbuwrUPPsN+n/m

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1432	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
1432	Au_.exe

Loads dropped DLL 14 IoCs

pid	Process
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x0009000000023408-3.dat	nsis_installer_1

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe
1432	Au_.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1432	Au_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1432	Au_.exe
1432	Au_.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1432	2848	05b2689119c8d9cf1428d0e9077a6a48_JaffaCakes118.exe	81
PID 2848 wrote to memory of 1432	2848	05b2689119c8d9cf1428d0e9077a6a48_JaffaCakes118.exe	81
PID 2848 wrote to memory of 1432	2848	05b2689119c8d9cf1428d0e9077a6a48_JaffaCakes118.exe	81
PID 1432 wrote to memory of 4484	1432	Au_.exe	82
PID 1432 wrote to memory of 4484	1432	Au_.exe	82
PID 1432 wrote to memory of 4484	1432	Au_.exe	82

C:\Users\Admin\AppData\Local\Temp\05b2689119c8d9cf1428d0e9077a6a48_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05b2689119c8d9cf1428d0e9077a6a48_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s /u "C:\Windows\system32\PopGameModule.ocx"
    3⤵
    PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsx80F8.tmp\AllRemover.dll

Filesize
52KB

MD5
c4c0c23f01fc5e2b407e2463e8f5080c

SHA1
7a55985593a6398d1a66883ae5f5929d4d9aee52

SHA256
ff0f59a359c306b0cb0a8ed935e2e1208d3532607c32ab849cccb7a15f09dd3d

SHA512
013232e5b14fae8aa83f1e2541370003911f8c827df8a4e419b0ba1f2c090033c97b2fb589e9e27935a45cda0ccf1a8f1076c3342e940b754845a2cec2a421de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx80F8.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx80F8.tmp\Math.dll

Filesize
14KB

MD5
bc8b9990819748dd57ccf28b73df57fd

SHA1
3e4f4bef94dec5745e49bdedd9c8ee85621d507c

SHA256
f7c310298a938c77b52094280b56da106d00a63705e2cc4b3eb2a730be01ade4

SHA512
fbeed46e079ae36ae26b655b3bae0cecd89181c8919b4a3aa03d4b32e3a8e365be0ab8df7ffa6e08576e4b8d797edc88a619e21af1d0d7df822250e2ffd3e57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx80F8.tmp\PopOcxUnRegister.dll

Filesize
156KB

MD5
ab8540a8551fcafe4b98ede6abed16d7

SHA1
6c578862af0bba65c3d83416d355d32ac53e7282

SHA256
e0b2cadebd50548535641e0543ec25f053633773604a6f30b0bbb667faf2088d

SHA512
813404e6bd98b472a590a1e486368034aee2811de325d1385211dbfc7e3367ad8b52dd9e13a8d78a8d1e69768e7bd778b8cf78a5601bc154bcd8a8a15562deee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx80F8.tmp\System.dll

Filesize
10KB

MD5
0c8ea8e6637bbf8408104e672d78ba45

SHA1
c231c7acaf9abb7da93f28e1b71bed164d57103e

SHA256
509a93177a7ae130bc3b6b5ec3236c7aa0811b8b86f8ab3442c65fdf8ff85b1f

SHA512
ee763a3cdbbba3b28e6a903ac942c7228bd8e54b19de21d6187e481f2916d833d9b9800e5ac2998f4aa26274cdfb20a8bfdd10f00f2a15d37bcc529b617e1f28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx80F8.tmp\UnInstallCount.dll

Filesize
116KB

MD5
f90028c2a72493b8e84585beca82d549

SHA1
60202a7086b9d905a122779524d1111081d85f00

SHA256
f57f2c64fdc084f4495992dd7930b1427fcb769377f167027d5b9dcf5e442729

SHA512
b32f99117f5d0ad099aab706fcf5262b227e5717070ab466b7bf2182944d730dc56900eaf7d6541f30093dfd27d3632d6a2474e11da85deb036c20203773c357

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
233KB

MD5
05b2689119c8d9cf1428d0e9077a6a48

SHA1
c231d46a81bbf94aa4dfa638111d291793d33f7b

SHA256
cd403b5283c695722f8197c1b749949d82c986842ebe06c4dbba838e1433339b

SHA512
ead14d0b5a261984e1d23f32237063b6f5caa9cff1892403798a2520025d267dc2f5a0013db13132bf82b82a07330b03286802da1ec93dfcdcd6abf159e58984

Download Submit