Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 06:49

General

  • Target

    217133608c034a74a74bf3c874c9a110_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    217133608c034a74a74bf3c874c9a110

  • SHA1

    8ebc1907e38b2016802246e7528db6ce2b06e02d

  • SHA256

    1c355669da81585afa9d76fa187d46a76fdeea3b8e76c221c799ca3b83c1dcb4

  • SHA512

    aa07e7e53f8a4cde6240d49a63647a3ecbe18a9b397801de09af5823a1cc843f564c53e3921d9c974bb99530262c491e35059eb8245f6ad6b09c29c6e2fb9abf

  • SSDEEP

    24576:eSNlDlT4xL2qSVJIOZYp+828FoB1fEGkrki:enKTVxxKW1fJkl

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\217133608c034a74a74bf3c874c9a110_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\217133608c034a74a74bf3c874c9a110_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\enemies-names.txt

    Filesize

    28KB

    MD5

    8468629d8d2e984eb8e1d054b3dbb282

    SHA1

    898b9c1a0c1c57053ff00ae02d4b8f01f1c8e93b

    SHA256

    19bef8562d7df6f0606952ddc995dad491423a0dd9899012cefc4e49fd9bc8a5

    SHA512

    dbfa83d6c299c4d86f296648ce2e55deb3eba5d9b45f035735cb51768475f542f23c18b4f8d22dd7e65249d0f214486df655db151348053fe875e2d4cbd937b3

  • C:\Users\Admin\AppData\Local\Temp\local.ini

    Filesize

    25KB

    MD5

    4cedefbdba364223db3bbc5b6647648d

    SHA1

    2456630305827aa2b090b65e646dac73bc8e29dc

    SHA256

    3e2b3d7fc990e3fb36e2e8ee83de74d29e71e04e8d37ee348d0f8ca86eb52f3b

    SHA512

    fc080dfadb4259c4a859b83a2a0fa8ef5518b96b7c756f9646b2f89b28a88aa8b72bdef9c8e2f314977448c28a1ecc07a973c31f716ae38a57102a958c91f564

  • memory/3032-545-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-543-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-2-0x0000000000404000-0x000000000064E000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/3032-541-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-542-0x0000000000404000-0x000000000064E000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-0-0x0000000001F60000-0x000000000205C000-memory.dmp

    Filesize

    1008KB

  • memory/3032-3-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-546-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-544-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/3032-547-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-548-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-549-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB

  • memory/3032-550-0x0000000000400000-0x0000000000656000-memory.dmp

    Filesize

    2.3MB