1d4cdfd45bc16e428ab9b3d1a84bb03535b4944d86b6b8f7955ed0e5a28338ee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2edac356071486500a99e798352bd73e_JaffaCakes118.exe
Size

128KB
MD5

2edac356071486500a99e798352bd73e
SHA1

b17efddf2fae25ba1b34af851812971b8b851b20
SHA256

1d4cdfd45bc16e428ab9b3d1a84bb03535b4944d86b6b8f7955ed0e5a28338ee
SHA512

c0e97bd69cbec253c584f3ca5b7e939f0eec7d8cfb7d1acef351b8576642b3f0015a430993b94713d678a0b86e8f00f19bac19c4a5584ba9486ced6cf81c523d
SSDEEP

1536:dKDqJvz2xyM40DSmJRsafuzE9y+3YkUnDHG1oL1nmz8AMszbmrQvLnpB6ENomyS8:dKDAfCDSmJRjj9tU+oJnmoiurGjp1yS8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2112	Nazi Zombies Mod Tools.exe
2352	readme.exe

Loads dropped DLL 7 IoCs

pid	Process
2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe
2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe
2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe
2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe
2352	readme.exe
2352	readme.exe
2352	readme.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2352	readme.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2112	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	30
PID 2512 wrote to memory of 2112	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	30
PID 2512 wrote to memory of 2112	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	30
PID 2512 wrote to memory of 2112	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	30
PID 2512 wrote to memory of 2352	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2352	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2352	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2352	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2352	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2352	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2352	2512	2edac356071486500a99e798352bd73e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2edac356071486500a99e798352bd73e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2edac356071486500a99e798352bd73e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\Nazi Zombies Mod Tools.exe
  "C:\Users\Admin\AppData\Local\Temp\Nazi Zombies Mod Tools.exe"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\readme.exe
  "C:\Users\Admin\AppData\Local\Temp\readme.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Nazi Zombies Mod Tools.exe

Filesize
137KB

MD5
c26c8edeb6ecab667cda7d1eaae49f96

SHA1
9a94cf2a55299588bed0ce86ed07e03667854725

SHA256
e5af49db365c9ced2e1b056a198c1f0343279856658b7012a5762b08c0a7edda

SHA512
e83455940afd00e71da05a0e2a687be9838f4896a948e301544436d2f2e70e4087cdea069dc7f4d89584fa5b28db4b61a8668f7576f7cd99b6db83e1c10084cd

Download Submit
\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
32KB

MD5
b15242452d12380433837e65de2c6b5c

SHA1
50f18de163f36e9327a8880fd4685e845f8ac2e4

SHA256
e3cb4d12e6fa9490b61fe1ac1a6950238eaa0681db938c5ff51097405ef6d566

SHA512
45a391636a67ba251064a14637ab542bf84692c528cf925999b3a698a25e27521ea4014538deeac1089c322d58af49d332a1948d7e85227853b5b2408774019b

Download Submit
memory/2112-13-0x000007FEF698E000-0x000007FEF698F000-memory.dmp

Filesize
4KB

Download
memory/2112-25-0x000007FEF66D0000-0x000007FEF706D000-memory.dmp

Filesize
9.6MB

Download
memory/2112-26-0x000007FEF66D0000-0x000007FEF706D000-memory.dmp

Filesize
9.6MB

Download
memory/2112-27-0x000007FEF66D0000-0x000007FEF706D000-memory.dmp

Filesize
9.6MB

Download
memory/2112-28-0x000007FEF698E000-0x000007FEF698F000-memory.dmp

Filesize
4KB

Download