Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2024 08:40

General

  • Target

    4d927d11d82abc18260f23310f7753da_JaffaCakes118.exe

  • Size

    49KB

  • MD5

    4d927d11d82abc18260f23310f7753da

  • SHA1

    3f7c83d8b6112533e9e9007dcc3d942aad6fe0ab

  • SHA256

    524b6ef6399dab851c6da36ac3d2569ea076b5403aac896a324d47c58acae148

  • SHA512

    45fe87dd3c0b9ff62028cbf9db310326705ec77dc3f1b87646036c83118810df56cb9261d7a1ff8c300d6c937023d9f22f64eaa53c772a78515f40266ad6ea93

  • SSDEEP

    768:RM6vXHIn3W6z2SXibYPIKLiQZXVHjVRyYLv+OJxy8XBb2ffxUTQKwyIVOrpJk:RMUonmaXi/EZX9yYLxvxksyYpJk

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
    • C:\Users\Admin\AppData\Local\Temp\4d927d11d82abc18260f23310f7753da_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\4d927d11d82abc18260f23310f7753da_JaffaCakes118.exe"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Windows\system32\mlJAronm.dll,a
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:2352
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cbXRIxYO.bat "C:\Users\Admin\AppData\Local\Temp\4d927d11d82abc18260f23310f7753da_JaffaCakes118.exe"
        2⤵
          PID:4324

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\cbXRIxYO.bat

        Filesize

        95B

        MD5

        769dc6951179a5282884e8584f3200df

        SHA1

        1fb2ba2351c96c1ed8f0227455d1075782722992

        SHA256

        207a03c4afd519e3a24048828d62e09662368f22046b52008877259d5a0961ee

        SHA512

        6d73728575e6a74910cfb1215ebaba92f453b1a0d3a52c2f7d997a8bf00ce6de5d1bd9bf6d8769b53b3ed9d60dfc19573edaacf3f96fb2763e1b9f4c7f2e2b04

      • C:\Windows\SysWOW64\mlJAronm.dll

        Filesize

        36KB

        MD5

        19e1e7bcdebf690b79c3195d66a1da8b

        SHA1

        ac46e2f4186c1b3c34d69889c419c98b85ca1a9b

        SHA256

        e1fe0e54cf7313f43ff34d5fbc9b8d8362672a7f64db48f5bd252cc6be94ba47

        SHA512

        ecf08f2048c77b31f18610f73799e7a82714e6ae82220168d56b8b600105bd52fe1cb99ad1601909721a4af7c698c4e81a7ccc93ecb9761b2c6609508fc70c26

      • memory/2352-18-0x0000000001140000-0x0000000001145000-memory.dmp

        Filesize

        20KB

      • memory/2352-17-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/2352-23-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/4800-0-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/4800-1-0x00000000005D0000-0x00000000005D5000-memory.dmp

        Filesize

        20KB

      • memory/4800-2-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/4800-8-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/4800-10-0x0000000010000000-0x0000000010015000-memory.dmp

        Filesize

        84KB

      • memory/4800-11-0x00000000005D0000-0x00000000005D5000-memory.dmp

        Filesize

        20KB