Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2024 10:05

General

  • Target

    3fad2378feab32b6d3f8b955d98038b2_JaffaCakes118.exe

  • Size

    18KB

  • MD5

    3fad2378feab32b6d3f8b955d98038b2

  • SHA1

    626d2a65d0c22ad510445171234d314bf93d0a2e

  • SHA256

    a62eac7125d6a8e953325e4408f6f6ab187c808f9bfc0334e4d8723fae97c021

  • SHA512

    4436ac40b5042eb768285dfdb074453a5431a145d24ec3b7211f296a00d09ec60f4fcf5a9e71ea02769df5f6598069bb8bbc2f425ddd777a168e51adb68c6cbe

  • SSDEEP

    192:cZh9iPRuyEmDYGpMtLYOzgfwN4rUMGA5+bc7+jR9nsVVI+1k1ygJtac:MhEMyRYGKtLUlxGC+bXsVK+1k1ygbac

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fad2378feab32b6d3f8b955d98038b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3fad2378feab32b6d3f8b955d98038b2_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\klmejjjw.cmdline"
      2⤵
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB2E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAB0E.tmp"
        3⤵
          PID:2716

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESAB2E.tmp

      Filesize

      1KB

      MD5

      f06540e09c627fb6248bc61aff1f4d8f

      SHA1

      f1ce6b593b4b92d11503dd9adbed96c616debae0

      SHA256

      ee024b390b4749d66b7e0bbb2af944364697143e1e7aa40fff986452c390c8a2

      SHA512

      78b892aa615c5df21f73ef680a251473eafbae59040a919bf12894f174234ce0bd0df51c313025930555a6844de9a131528c5e81be514add848a52b073b26f80

    • C:\Users\Admin\AppData\Local\Temp\klmejjjw.0.vb

      Filesize

      193B

      MD5

      c9affc499509d8a9c1b93e9590e55d7f

      SHA1

      832ddeefbe416bb4bb5349e3d44d660cf69614c6

      SHA256

      4e4d855ef36455df9965a719b2ecaf3e5f1fc3fb614eba6c377e4b3696106249

      SHA512

      fdb98921f4001e56d46dd17975fa41e76e6f2028d509cd38266e5889279690ab04d0548547ab26629bfba3855b0e6817650abac5e6f086a464ed56bfb3b4f16c

    • C:\Users\Admin\AppData\Local\Temp\klmejjjw.cmdline

      Filesize

      193B

      MD5

      9a9839e2c3f7901e7e92fa624407876c

      SHA1

      e1a472fc9cac1d53838a4ee3c10ae582ed2da7ad

      SHA256

      9c9492bc2b381bc70d3d79a491f872e5bf14195104283bb888c15ec6f34decaa

      SHA512

      f122b63959870d80bb0511f05ebc74e7d281699c0a629c149a29bf238bca75e1ab33b38c47d39cc83925be12115d9e836610b8d5f28a214cc9a6406c7abdf54d

    • C:\Users\Admin\AppData\Local\Temp\vbcAB0E.tmp

      Filesize

      636B

      MD5

      4ae835497e2f7ceaf82995a952ab9488

      SHA1

      4800591a27a535f287c294cb30e79f951ffa6e93

      SHA256

      f2811dc74cc9db37a8327e8cf3b9b87c86a1628446178c6fd53476c9293a8ca5

      SHA512

      e292c23402150a0031fb01997ed8e7cf3871957906360fad7f6fbdc2f9695791020fab8ce066436aa96c17811a84174ce5b7206e16a98f8b3ddebe4ff217e19c

    • memory/2220-0-0x000007FEF59DE000-0x000007FEF59DF000-memory.dmp

      Filesize

      4KB

    • memory/2220-1-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2220-2-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2220-3-0x000007FEF59DE000-0x000007FEF59DF000-memory.dmp

      Filesize

      4KB

    • memory/2220-4-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2616-11-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

      Filesize

      9.6MB

    • memory/2616-19-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

      Filesize

      9.6MB