Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10-08-2024 00:55

General

  • Target

    8437a94ec2f1575a92b9e0120dfd6fee_JaffaCakes118.exe

  • Size

    179KB

  • MD5

    8437a94ec2f1575a92b9e0120dfd6fee

  • SHA1

    8e9b8c5bcb73394b79affee52e6fb747a8ed7d23

  • SHA256

    e547ccdbb90d4c82fe83452d3a865e59e82ca3ec36ee622a40877934ffa07f7e

  • SHA512

    48df5a485b2d6d1137a7288d67c90f686f1d10d3494c42eeb9ae3af8c7d3e80ae184b57483763d9fe91e1966a6898382c35faa55819d24de2a99d60f19dec04d

  • SSDEEP

    3072:H3LEBAHGwuJ6q9VwUw5wi8KVQbeElo1cx0tfJzLClv6Yjw5qm9oJl3HtmSKu:XLE6GHHVwJL5h9JzL0voT9cH

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8437a94ec2f1575a92b9e0120dfd6fee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8437a94ec2f1575a92b9e0120dfd6fee_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:532
    • C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:576
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
        PID:1172

    Network

    • flag-us
      DNS
      nnef9gpy8hegvh.org
      netsvcs
      Remote address:
      8.8.8.8:53
      Request
      nnef9gpy8hegvh.org
      IN A
      Response
    • flag-us
      DNS
      n038rf9hwj9u0ef.org
      netsvcs
      Remote address:
      8.8.8.8:53
      Request
      n038rf9hwj9u0ef.org
      IN A
      Response
    • flag-us
      DNS
      nr9e8fpuhi89ehf.org
      netsvcs
      Remote address:
      8.8.8.8:53
      Request
      nr9e8fpuhi89ehf.org
      IN A
      Response
    No results found
    • 8.8.8.8:53
      nnef9gpy8hegvh.org
      dns
      netsvcs
      64 B
      146 B
      1
      1

      DNS Request

      nnef9gpy8hegvh.org

    • 8.8.8.8:53
      n038rf9hwj9u0ef.org
      dns
      netsvcs
      65 B
      147 B
      1
      1

      DNS Request

      n038rf9hwj9u0ef.org

    • 8.8.8.8:53
      nr9e8fpuhi89ehf.org
      dns
      netsvcs
      65 B
      147 B
      1
      1

      DNS Request

      nr9e8fpuhi89ehf.org

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\69AB.tmp

      Filesize

      1.2MB

      MD5

      d124f55b9393c976963407dff51ffa79

      SHA1

      2c7bbedd79791bfb866898c85b504186db610b5d

      SHA256

      ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

      SHA512

      278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

    • \Users\Admin\AppData\Local\Temp\69CC.tmp

      Filesize

      1.1MB

      MD5

      9b98d47916ead4f69ef51b56b0c2323c

      SHA1

      290a80b4ded0efc0fd00816f373fcea81a521330

      SHA256

      96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

      SHA512

      68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

    • \Users\Admin\AppData\Local\Temp\6A1B.tmp

      Filesize

      202KB

      MD5

      7ff15a4f092cd4a96055ba69f903e3e9

      SHA1

      a3d338a38c2b92f95129814973f59446668402a8

      SHA256

      1b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627

      SHA512

      4b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae

    • memory/532-90-0x0000000000090000-0x00000000000E1000-memory.dmp

      Filesize

      324KB

    • memory/532-74-0x0000000000090000-0x00000000000E1000-memory.dmp

      Filesize

      324KB

    • memory/532-100-0x0000000000090000-0x00000000000E1000-memory.dmp

      Filesize

      324KB

    • memory/576-78-0x0000000000090000-0x00000000000E1000-memory.dmp

      Filesize

      324KB

    • memory/576-99-0x0000000000090000-0x00000000000E1000-memory.dmp

      Filesize

      324KB

    • memory/2808-51-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-46-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-25-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-44-0x0000000000F00000-0x0000000000F61000-memory.dmp

      Filesize

      388KB

    • memory/2808-62-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-61-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-60-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-59-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-69-0x0000000000F00000-0x0000000000F61000-memory.dmp

      Filesize

      388KB

    • memory/2808-77-0x0000000000F00000-0x0000000000F51000-memory.dmp

      Filesize

      324KB

    • memory/2808-68-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-67-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-66-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-65-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-64-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-63-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-58-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-57-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-56-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-55-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-12-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-54-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-53-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-52-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-3-0x0000000000F00000-0x0000000000F51000-memory.dmp

      Filesize

      324KB

    • memory/2808-50-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-49-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-48-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-47-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-18-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-72-0x0000000000F00000-0x0000000000F61000-memory.dmp

      Filesize

      388KB

    • memory/2808-71-0x0000000000F00000-0x0000000000F61000-memory.dmp

      Filesize

      388KB

    • memory/2808-45-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-43-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-42-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-41-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-40-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-39-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-38-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-37-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-36-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-35-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-34-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-33-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-32-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-31-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-30-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-29-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-28-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-27-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-26-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-24-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-23-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-22-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-21-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-20-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-19-0x00000000008D0000-0x00000000008D9000-memory.dmp

      Filesize

      36KB

    • memory/2808-1-0x0000000000540000-0x0000000000561000-memory.dmp

      Filesize

      132KB

    • memory/2808-0-0x0000000000510000-0x0000000000532000-memory.dmp

      Filesize

      136KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.