Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 00:13

General

  • Target

    181366d1498ac747f07f0bb05122f209_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    181366d1498ac747f07f0bb05122f209

  • SHA1

    803f6a776f4171ddf425e85c52204c04e1d7ae5b

  • SHA256

    5561e38e23520ee0e034c9ecd94fcf73eed03216a1b458c118704515941528dc

  • SHA512

    7cb1a9e64119bdb389dc57dc69379ffeb3398e07920d5598ffe9ade59a7951d44ad8920b83396cdc0ed8682f853f2243393866f9581f86da7008887b04353039

  • SSDEEP

    6144:BZu9i2ZPJWxEgSgKyHbSkGhO9i2ZPJWxEgSgKyHbSkGhXb9i2ZPJWxEgSgKyHbSr:TEeDSUSkeDSUSXxeDSUS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\181366d1498ac747f07f0bb05122f209_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\181366d1498ac747f07f0bb05122f209_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Temp\BFile1.exe
      "C:\Users\Admin\AppData\Local\Temp\BFile1.exe"
      2⤵
      • Executes dropped EXE
      PID:2944
    • C:\Users\Admin\AppData\Local\Temp\BFile2.exe
      "C:\Users\Admin\AppData\Local\Temp\BFile2.exe"
      2⤵
      • Executes dropped EXE
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\BFile1.exe

    Filesize

    7KB

    MD5

    d999da3bbc30e21d4c86c6c5b6dc7826

    SHA1

    95d67e5a5b7bcb386f6ba197e5c708f9fe6d67b3

    SHA256

    fd1f9e684b72262cf964f5d1d8961103d8f35a6c4f4e8c4588f26d7c51ee89f2

    SHA512

    38ca2df0ebd05128368c09a374085086a1c3894e03a9a947a8ffa0d82766e70acb8ec3fbf807ca34d8b2568595cefa1d72cf7a823d92f0cbd509263b46fe5cad

  • C:\Users\Admin\AppData\Local\Temp\BFile2.exe

    Filesize

    1.1MB

    MD5

    0ec934b0c3fa5ae5725c143cc40d6662

    SHA1

    e6c8d009d77e833d5fba614d18235bb1d4d48e48

    SHA256

    e7350e1b83ce8b46848ad91cd4479c34c032a64b5c5b9ecfa471419a3c70780a

    SHA512

    1597d62331fc8649b42a2e04123b540f8182c702f14c71c84cb4ae9346649e33502af02505f5d4a2e1c58156dbd53afa9a3b33347e667fc411a2c692e02eefc1

  • memory/1848-0-0x000007FEF5D1E000-0x000007FEF5D1F000-memory.dmp

    Filesize

    4KB

  • memory/1848-1-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB

  • memory/1848-2-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB

  • memory/1848-3-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB

  • memory/1848-18-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2556-19-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2556-17-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2556-20-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2556-21-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

    Filesize

    9.6MB