9a7aff2310831face11c151ecd8f8ee19c36570ad26124eaa42e323b617a04a3

Analysis

max time kernel
149s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe
Size

2.0MB
MD5

5d3e9806b97e8321e23a20ce88caa48b
SHA1

7216a9b6930cee320e9b5062a346f93116c445cf
SHA256

9a7aff2310831face11c151ecd8f8ee19c36570ad26124eaa42e323b617a04a3
SHA512

4cd16f46fc80a9ccc4d46e3cc2fe74600cf23eba0aeac19f88c795f8502d632f13186890ef51e2ea3cb3fdedc650c47165b759e35733f90e50568a6a06fabb3c
SSDEEP

49152:0aRhyb24ycJbGOWfwcWAgAYtcpvyTBzJwOnTo:5RhWBkwcXg1icltXnE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
2956	rkverify.exe

Loads dropped DLL 8 IoCs

pid	Process
2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
2956	rkverify.exe
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe
2956	rkverify.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1572	2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	30
PID 2380 wrote to memory of 1572	2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	30
PID 2380 wrote to memory of 1572	2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	30
PID 2380 wrote to memory of 1572	2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	30
PID 2380 wrote to memory of 1572	2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	30
PID 2380 wrote to memory of 1572	2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	30
PID 2380 wrote to memory of 1572	2380	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe	30
PID 1572 wrote to memory of 2956	1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp	31
PID 1572 wrote to memory of 2956	1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp	31
PID 1572 wrote to memory of 2956	1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp	31
PID 1572 wrote to memory of 2956	1572	5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp	31

C:\Users\Admin\AppData\Local\Temp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\is-DQ8QT.tmp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DQ8QT.tmp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp" /SL5="$4001C,1758437,211456,C:\Users\Admin\AppData\Local\Temp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Local\Temp\is-I7IK1.tmp\rkverify.exe
    "C:\Users\Admin\AppData\Local\Temp\is-I7IK1.tmp\rkverify.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\CSMC4A6.tmp

Filesize
160KB

MD5
5ac09190daf249c3e93c3ac961067024

SHA1
bad9c0d552d54310f669d66b549dcada90583812

SHA256
f4934185f75518a13ef5425959f47516cc8467f513e838a82e749ffb782d7e23

SHA512
2a87686c038e8a34f8e04a844726de564a08baeedc87632219b86f455d5222efe2ed7557fad9658627e304d916a75cfcb3c9dede4e72057a070f64370aa52f39

Download Submit
\Users\Admin\AppData\Local\Temp\is-DQ8QT.tmp\5d3e9806b97e8321e23a20ce88caa48b_JaffaCakes118.tmp

Filesize
841KB

MD5
077ba43e4c4652f5c9527a12f015fd67

SHA1
c879d5b76642aa4ad76e77f1b58c4af58ba12edd

SHA256
b0846555df7c199b5fff2ec29f98ac8eec0e7046a8f201753406c379e89adf92

SHA512
6ffebc613d25d8006af66e4d3df56b2c9acaae89204451a0e609426ae45ecb576910bd9534d2c67a01d9207988053140841b00303f84b3d061038e35ce52b3c1

Download Submit
\Users\Admin\AppData\Local\Temp\is-I7IK1.tmp\FileDe.dll

Filesize
385KB

MD5
10bb1bda06871deb8d0506b4f6390b6c

SHA1
ac96f51cb1f1d9e341eca88b47a734bfb1e3f494

SHA256
0124f82f392a3156edc5380f28ac19caecc89682a7556f28a2172681d923ac84

SHA512
01afabb1f5458bf928787c69b4078f5ba738ff427989aa6a3775c8bac659f98b81e4c4acccaf093815afea7bad37bda0cfb07c088bac4eda2fdf149003e3aa62

Download Submit
\Users\Admin\AppData\Local\Temp\is-I7IK1.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-I7IK1.tmp\rkverify.exe

Filesize
268KB

MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
memory/1572-8-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1572-18-0x0000000001F90000-0x0000000001FF6000-memory.dmp

Filesize
408KB

Download
memory/1572-38-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1572-41-0x0000000001F90000-0x0000000001FF6000-memory.dmp

Filesize
408KB

Download
memory/2380-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2380-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2380-37-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download