Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 20:43

General

  • Target

    4b5223b206848661edf56172340281a8_JaffaCakes118.exe

  • Size

    3.6MB

  • MD5

    4b5223b206848661edf56172340281a8

  • SHA1

    0b1cf71ae15fc2d703a8fd73651ddd6dd96f0f39

  • SHA256

    dad07819cf10e0c224b15b874e0278fb5e851601f52a4d00b173b5c405c18b5c

  • SHA512

    cff498531d441f206dafa04424493b27e3133b42785becc6ac1cabdaca7761a9cbcfb0b7f49b6bf9ca5dacf3dbd1050872e1d00608e7d400fad8061d6df7152a

  • SSDEEP

    49152:i0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIakLmEe:i36ivJDiSFdph1mPYAlO/hJ6ZYWwqn9

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b5223b206848661edf56172340281a8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4b5223b206848661edf56172340281a8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\nse55F.tmp\InstGameInfoHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\nse55F.tmp\InstGameInfoHelper.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:1916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    13f176bef9f42983fd8374b6a3c8d564

    SHA1

    ae29ffe61b498dfc8579e76ae2b28fe79084dca4

    SHA256

    fc54a9629ede658dd615a4fc77e136e9048294a96bc6ad0f365f117db3640f77

    SHA512

    2c34ee5d004b55e91b488b13e1f525aecb4b7b51c5289f7437da0cca4afbc18cb4b190eace5fe54a801b487ac34885cfb55d85bc5cc7df8ed692b00646d72e27

  • C:\Users\Admin\AppData\Local\Temp\Cab1509.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar153B.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\nse55F.tmp\ftdownload.dat

    Filesize

    512B

    MD5

    28c1ac550c09a03dfd2a7b95c624ab0b

    SHA1

    b800420329c92a0fe6310f1ee429fde43eb38e85

    SHA256

    b1a130b71dcc388ef3ef865ce94b7479e07e92a0ec5363319296ab5cf1ae36a5

    SHA512

    6dd3859ab13e5b97572e4bdff67030220d8e6a2bd45d8d83917c5b774842f8d399f8323bb7852293142723ef2b72b65e873b2cf12976cf9b42d601c9b1fa3afc

  • C:\Users\Admin\AppData\Local\Temp\nse55F.tmp\gametitle.txt

    Filesize

    24B

    MD5

    91bbf79dd26c5ab6a2f8fac8db58beac

    SHA1

    cc8f5755e22637f90f865b9993c691a7caa57111

    SHA256

    34d6f1744136113a6386060fc34f0b58cbd48232282ac77f434df4d8f23e1682

    SHA512

    3b24325f676724c99ba0d81c5e2029a5db297853929d7b1ae3a1a2ba496177f83daa6e361b32309a75781ac73850d43a333c97e944db5a8b28ef487b0a20efce

  • C:\Users\Admin\AppData\Local\Temp\nse55F.tmp\tn_feat.bmp

    Filesize

    4KB

    MD5

    aaeff1442865fbdb5a19b15018ab5b8a

    SHA1

    a22773696b615cfb4ceb06f1b441696bef2fd49c

    SHA256

    6da8cc04ec6c41c072e534d4e0b49ff82ece30eab2097a77fb055e135a44cc2a

    SHA512

    b7a2e3009cf4cbe6974d4cd652943e4fbbd432299510f5465a5900851b5031d8a6034d2698be43c9a5da601d661f2c21dd89a42bc2ad4d464db6ab32f15cf0cf

  • \Users\Admin\AppData\Local\Temp\nse55F.tmp\InstGameInfoHelper.exe

    Filesize

    99KB

    MD5

    3d3d2bf9c42dbdf97247775c00f22190

    SHA1

    7a046170aaeb5e1a29d8c8cd7c32225f49237aa1

    SHA256

    59f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a

    SHA512

    6e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466

  • \Users\Admin\AppData\Local\Temp\nse55F.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nse55F.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    acc2b699edfea5bf5aae45aba3a41e96

    SHA1

    d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    SHA256

    168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    SHA512

    e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe