Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 15:14

General

  • Target

    42379e70bb511d7659943faaa3d84e1c_JaffaCakes118.exe

  • Size

    125KB

  • MD5

    42379e70bb511d7659943faaa3d84e1c

  • SHA1

    e885091986a50c70e2d6179c3ecddaca1ac1d425

  • SHA256

    15e582c0960adb412c05316336dab08438bf563391e64f636945aa8849251da9

  • SHA512

    dc6ab52e3b85f1cd2a0404984b0775a9647dec61e9a37e8ecbcde177f8b0542633e4c9958c077fd98184e82d75163b87be0edc6762d7ee72b82da5ff53a36042

  • SSDEEP

    3072:EJgwBIxhn+dz7diTqkGqcZBUPs7dHNnu3lAzyDJkluJfBd8W:EuwWx8fScnUPey1BtB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42379e70bb511d7659943faaa3d84e1c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\42379e70bb511d7659943faaa3d84e1c_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\Okohua.exe
      C:\Windows\Okohua.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Okohua.exe

    Filesize

    125KB

    MD5

    42379e70bb511d7659943faaa3d84e1c

    SHA1

    e885091986a50c70e2d6179c3ecddaca1ac1d425

    SHA256

    15e582c0960adb412c05316336dab08438bf563391e64f636945aa8849251da9

    SHA512

    dc6ab52e3b85f1cd2a0404984b0775a9647dec61e9a37e8ecbcde177f8b0542633e4c9958c077fd98184e82d75163b87be0edc6762d7ee72b82da5ff53a36042

  • C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

    Filesize

    372B

    MD5

    c6bfe4970d1571459a6d16d3eaa6cbdb

    SHA1

    a880bfbae3f4057073ccbf94e19d47c63895b094

    SHA256

    cceb7071810ff9821e7870542a0757a3c2e8e590d99bd0fb67998e43bbe85c1a

    SHA512

    0dedb66822dffa711e0c521769f8dcebbd0c1971aa81fe8db00ac77e67e8d7a8c50ca971e601ba6a470ae8fffcc3206d8a00eec105fa355599f78ea0ef198437

  • memory/2676-1-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2676-0-0x00000000003E0000-0x00000000003F3000-memory.dmp

    Filesize

    76KB

  • memory/2676-46437-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-10-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-11-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-46438-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-46439-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-46440-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-46441-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-46442-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-46444-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2780-46448-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB