Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    24/07/2024, 03:30

General

  • Target

    6a14942060a98685a1acf08dda97a62d_JaffaCakes118.exe

  • Size

    232KB

  • MD5

    6a14942060a98685a1acf08dda97a62d

  • SHA1

    765819ac4d0529e8318926fe9cfdd95b313ad4d9

  • SHA256

    6172ca0fac5eaaf4ce09d2ef879fcd3fa3fc67213e9714cea0c2b543e12aad57

  • SHA512

    4cfffdf993e5e7f01142b96ad1beb799132cd11cf8bcf36b086eb54ee71def29d52f45485ea4b25a93e343760087b93f0b6ccea543f346b78289bfd71f422ca4

  • SSDEEP

    6144:zr3PFKs7diixRSFBfWEqxF6snji81RUinK51jbkxku1ST:zbPhJuBXVbkxJ1G

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a14942060a98685a1acf08dda97a62d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a14942060a98685a1acf08dda97a62d_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Users\Admin\maaerib.exe
      "C:\Users\Admin\maaerib.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\maaerib.exe

    Filesize

    232KB

    MD5

    27ab4d65e95cb718858e49f65cfbe806

    SHA1

    a8d727720c7bd24710de8c13fea4bc6289a18dd1

    SHA256

    b7d71d14efab28ba35e911a24c315de868ee8bb11cbd42e4a6fbb71cb0fefb25

    SHA512

    9ada2a8bbe45c04c732fca6539bcb48a92820b1c271d31f0f9b120354d209378f33de4be6aee1b1f98b2fdc73555a843b89a4fdc6f4822c2f5dc4a77ca3bceb2