Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2024, 18:57

General

  • Target

    29448e16a6674929aab97ffd0d024f98_JaffaCakes118.exe

  • Size

    64KB

  • MD5

    29448e16a6674929aab97ffd0d024f98

  • SHA1

    3abfc29043ecdb9a76c445e763e99586a9896fc0

  • SHA256

    4ee7600463fd262e9cda27a26a7293e0260e369a8646c0ae26ad3bf9988c2143

  • SHA512

    215093b42d4de55d2c8700d5f2687bd12e495775170ca62fe6a5a2e6938ef2929dac439f61619073d03eec7e07a35863152753afce2507236a4660357c43bda6

  • SSDEEP

    768:4ivR95RwDKtqfNJSFzo/8Bt2Xiz7bYoh8T0Bz4rVqc1s7GPAyeGYbpae2o7CDW:4q95btqfNUiGt2G8IBW9TAynYb3gDW

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29448e16a6674929aab97ffd0d024f98_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\29448e16a6674929aab97ffd0d024f98_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\MSV\nvsD174.tmp.bat" "
      2⤵
      • Enumerates connected drives
      PID:2020
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i \n2H.msi /quiet
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:604
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
      2⤵
        PID:1688
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\29448E~1.EXE > nul
        2⤵
          PID:1640
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2064

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

              Filesize

              768B

              MD5

              d20d9eda31a2d0300e4589df7f352370

              SHA1

              79b46d2dbb489914cfedafdbc90e62951471b48e

              SHA256

              d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8

              SHA512

              d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

            • C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

              Filesize

              57B

              MD5

              f755a673381fda6fdf85ac115974b84b

              SHA1

              86cb87539675c441f0d1f02f7ede7dae4905d8af

              SHA256

              84f138e3553e010d41ed246eb4e4d4e438e73d15ee886f19d2530d87f1d27f71

              SHA512

              bf6555f23aab63c6cbcaae0921b2e7a2d2a2755295fe0e7c8c3d77d197e463567fa678631477a2bfcee49d18766a4e8117554d72b0837f988a02cf0678444561

            • C:\Users\Admin\AppData\Roaming\MSV\nvsD174.tmp.bat

              Filesize

              2KB

              MD5

              cc026bb8e7fc24bcac4b127fd0eab984

              SHA1

              f32b1c8d9bf80b56f2dbec1c27f72f05188e5ba4

              SHA256

              add1523a20de316094784a5ff5ef21bfff6cfcc1d7ba5c34a3b1bd77f9762f7f

              SHA512

              0bdf850bb49b0ffcce90aa0c3713b12204769bb79615ed52d8a6b7a0081874b3137108510e2e560d4c5106e3796205065182935007d28a8eee3ebdc33d1064e0

            • memory/2020-59-0x0000000000370000-0x0000000000371000-memory.dmp

              Filesize

              4KB

            • memory/2892-0-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/2892-1-0x0000000000020000-0x0000000000023000-memory.dmp

              Filesize

              12KB

            • memory/2892-5-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB

            • memory/2892-7-0x0000000000020000-0x0000000000023000-memory.dmp

              Filesize

              12KB

            • memory/2892-31-0x0000000004A60000-0x0000000004A70000-memory.dmp

              Filesize

              64KB

            • memory/2892-78-0x0000000000400000-0x0000000000429000-memory.dmp

              Filesize

              164KB