Analysis

  • max time kernel
    139s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 07:58

General

  • Target

    48e6298e35936b9583692bf232ada2aa_JaffaCakes118.exe

  • Size

    164KB

  • MD5

    48e6298e35936b9583692bf232ada2aa

  • SHA1

    34d18c8a565781d0992b3241a2e0ebbf7c734f7f

  • SHA256

    06d198c028d7dd5738c593fba07d0c448594f20de1e43c636bda7f5d53ff7fe6

  • SHA512

    b192dca9237b6c816175a0975ac4c11da2b18bb5dc922ad5f1207370c45015bbfd5e445b4dce50236c1bba164c0fc1320a63634da6f3bf12f312e62c8ba159c3

  • SSDEEP

    3072:0PD8KgMqZSKBzkSCbPJHr63Vq4hslJ3BJohpCHxMhmZxECQ1:YD1KNgbPtr6FqbBJbHxMmZxEH1

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48e6298e35936b9583692bf232ada2aa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\48e6298e35936b9583692bf232ada2aa_JaffaCakes118.exe"
    1⤵
    • Sets service image path in registry
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\48E629~1.EXE > nul
      2⤵
        PID:4772
    • C:\Windows\Fonts\D74A3BB0.EXE
      C:\Windows\Fonts\D74A3BB0.EXE -k
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      PID:3424

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\Fonts\D74A3BB0.EXE

            Filesize

            164KB

            MD5

            48e6298e35936b9583692bf232ada2aa

            SHA1

            34d18c8a565781d0992b3241a2e0ebbf7c734f7f

            SHA256

            06d198c028d7dd5738c593fba07d0c448594f20de1e43c636bda7f5d53ff7fe6

            SHA512

            b192dca9237b6c816175a0975ac4c11da2b18bb5dc922ad5f1207370c45015bbfd5e445b4dce50236c1bba164c0fc1320a63634da6f3bf12f312e62c8ba159c3

          • memory/3424-7-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4632-0-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4632-6-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB