Overview

overview

10

Static

static

3

2de413a923...18.exe

windows7-x64

10

2de413a923...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 21:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2de413a9235364aa8e077f4d381a7e5d_JaffaCakes118.exe

  • Size

    544KB

  • MD5

    2de413a9235364aa8e077f4d381a7e5d

  • SHA1

    f0ccaa9c9f7f3a30d7da2c9fdd9c2ca6682530bb

  • SHA256

    ea28af3830b92c38177aea440350b5608eb2302dbadcc6734447cfdbf18499f5

  • SHA512

    dca3fa26c5a1d1979060837cf020add714e3843d550601a40abb4b1363cb0ba32faeb1b51e8df3ee72f86fd16217688c47bd39f1877c4d9bd8a48a0e76f46b10

  • SSDEEP

    12288:xeXr/Cm+XQ9i8aMVkUet7EwBI+APu4Ujk0m7:xGr/Cm+X18zVkUetVI5u4+Vm7

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 48 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 47 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2de413a9235364aa8e077f4d381a7e5d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2de413a9235364aa8e077f4d381a7e5d_JaffaCakes118.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
      C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
      2⤵
      • Executes dropped EXE
      PID:2056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 412
      2⤵
      • Program crash
      PID:1376

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Replication Through Removable Media

        1
        T1091

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Modify Registry

        3
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Replication Through Removable Media

        1
        T1091

        Collection

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        1
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Mr_CoolFace.scr
          Filesize

          544KB

          MD5

          2de413a9235364aa8e077f4d381a7e5d

          SHA1

          f0ccaa9c9f7f3a30d7da2c9fdd9c2ca6682530bb

          SHA256

          ea28af3830b92c38177aea440350b5608eb2302dbadcc6734447cfdbf18499f5

          SHA512

          dca3fa26c5a1d1979060837cf020add714e3843d550601a40abb4b1363cb0ba32faeb1b51e8df3ee72f86fd16217688c47bd39f1877c4d9bd8a48a0e76f46b10

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Autorun.inf
          Filesize

          97B

          MD5

          e0b7531a87635a0a11dbd9edc02c7bed

          SHA1

          74a50849add50351da332164cbf0ae74a43ce8fe

          SHA256

          20e16cf8b48b2bf3adc59251e7dc293c39eb87922d267a768a403fb76f13d765

          SHA512

          e6cbf6e11ad29d17c219ca44ebbcb43adb76bef3d688f38e43520faded492caff162e249bd477f5441858a26eb567c3f70be3cf3cc181a2fb62aaae4efd23c67

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Mr_CF\Desktop.ini
          Filesize

          212B

          MD5

          ca815edf2e481dd83bd0cff16caaf7a7

          SHA1

          523fa767fac1b4061762c0262d4bc09a1fa7dddf

          SHA256

          f2566afa47cadf4017f82ee80f11355989fd722fbbbbed1954392bbe2aa2b352

          SHA512

          cef1cf04432326393cd700b6c9c4d3d816a61505a3ba99bafc935ffd52a78635130a752d091dd6511d9781ac9458a404bcfc69ca0cdec55da418b3b8bf9dace2

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Mr_CF\Folder.htt
          Filesize

          631B

          MD5

          5313060d847a33c356e4e8e286e3de73

          SHA1

          d2b5e89f1fbb96895371e1cde7997ff76814ea9e

          SHA256

          ee482ee2540efc03f1cba611170096f68e14fd4d39bdc8650f3ef6900799fafc

          SHA512

          8c90a8fd5372dadfe95df1deb07bbd14355620dd067b2cce58f76230e2f99129daf65ddc056cab0902ab2b70a4b838a484f62f37b0436e21a963dd1156f551b0

          Download Submit

        • \Users\Admin\AppData\Local\Temp\inf4D2.tmp
          Filesize

          55KB

          MD5

          373e7a863a1a345c60edb9e20ec32311

          SHA1

          849abaa9c524ff6da8891c3da01350c18ea1a1d4

          SHA256

          a6fc95a5b288593c9559bd177ec43bf9b30d8a98cf19e82bf5a1ba5600857f04

          SHA512

          c6dc444f8b19db801acfd816c37fe03f52eb03b17b20aac5a9fed18c69b513c2abd7b90399dd4d11650f037408fe02fc0e594305edb5a3655cff252815636cad

          Download Submit