Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 14:48

General

  • Target

    42228db7c724a4b4667ad879504cd349_JaffaCakes118.exe

  • Size

    11KB

  • MD5

    42228db7c724a4b4667ad879504cd349

  • SHA1

    c33c187f006c015bfd50120857dea60bb3dffb1d

  • SHA256

    8c56fdc227fa81e93a332ae747aff3bd528f2bb904fe988044d8888782bae1a7

  • SHA512

    6cdfb10f9794b45446bbed31f67a37a3e148ba19bc0f1f8ad8674257358cd48a6617f9338d2fb80e1c850faf43baf49df82bd5bf925614fc5f281d7a56015c4e

  • SSDEEP

    192:SFYTGEP2lxAcdItUI//ChZoF+GXzLvZgSIlA1OVgB0FriVfaQmwLNZ+hh4tlS50v:oYTjubVw/ChZOHzzZJ/1Ouy9ixakIaWG

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1136
      • C:\Users\Admin\AppData\Local\Temp\42228db7c724a4b4667ad879504cd349_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\42228db7c724a4b4667ad879504cd349_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Program Files\Internet Explorer\RAVDHMON.exe
          "C:\Program Files\Internet Explorer\RAVDHMON.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2392
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\42228db7c724a4b4667ad879504cd349_JaffaCakes118.exe"
          3⤵
          • Deletes itself
          PID:1680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Program Files\Internet Explorer\RAVDHMON.exe

      Filesize

      11KB

      MD5

      42228db7c724a4b4667ad879504cd349

      SHA1

      c33c187f006c015bfd50120857dea60bb3dffb1d

      SHA256

      8c56fdc227fa81e93a332ae747aff3bd528f2bb904fe988044d8888782bae1a7

      SHA512

      6cdfb10f9794b45446bbed31f67a37a3e148ba19bc0f1f8ad8674257358cd48a6617f9338d2fb80e1c850faf43baf49df82bd5bf925614fc5f281d7a56015c4e

    • memory/1136-11-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

      Filesize

      4KB