Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 23:02

General

  • Target

    0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe

  • Size

    13KB

  • MD5

    0fd9de7ade782e98932527224de8190d

  • SHA1

    77a3599c64b13b7848d876f431e6ed438d5f1eeb

  • SHA256

    b658e2e642ebcc72efdc36341a604252703231db7a59ed85463eac8fb8be34f7

  • SHA512

    304176f5dda65b7c8cf9364b61399cd0902edd22440ab40584c33658bcb24969b6d7d612fe209811a5ca2658055458d29d33350eff3e5962a16a3f6f436aaa3b

  • SSDEEP

    384:DxmI6AoJtteqexodGcuudFOvmRr4qHB+v:9mLtteVxrNud8vm9nHB+v

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d_JaffaCakes118.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\8640.tmp.bat
      2⤵
      • Deletes itself
      PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8640.tmp.bat

    Filesize

    207B

    MD5

    02c560d362e0721e992f2c9dfad1a007

    SHA1

    99038dff5a34c6e53d13c3bd7aca5b01bcfcee99

    SHA256

    de08ec400913eb50a4522bec9a399c2fa0a530304eafc23b36b77aed623ffc49

    SHA512

    d384927c35bb1c70f11b736c53204c424a515cf06291cf0468da8c65f906d1e16572a68afb273c78954ae340a4b3b2b57a219df0da96e4cecd0a0667fd6cae3f

  • C:\Windows\SysWOW64\cliconfgzx.dll

    Filesize

    677KB

    MD5

    343f345a18dee73fc5d43a53e83e25c6

    SHA1

    01e8fbd97a2f68377cae7bf159c921b1a8388ce3

    SHA256

    6419af112c17edc95102675710543646d6daf2ffba4d7cf77dd36512253fd4ba

    SHA512

    33e8b1895b49f8d11c0cb6beb01f45d7aab5ab2f4345ec709b86134451219d2cdfa30771b9d5ec1b16147d688304919d37dd30e89b2bf3481ab9e83149fd15b4

  • memory/2204-8-0x0000000020000000-0x000000002006C000-memory.dmp

    Filesize

    432KB

  • memory/2204-18-0x0000000020000000-0x000000002006C000-memory.dmp

    Filesize

    432KB