Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10-08-2024 00:16

General

  • Target

    841dfe3eaafe68cc0b989fbf55a34c9c_JaffaCakes118.exe

  • Size

    148KB

  • MD5

    841dfe3eaafe68cc0b989fbf55a34c9c

  • SHA1

    2c10358634f2b96ffe284341e96801e8b57c80e0

  • SHA256

    72d40c0fa8f179c2917455df6d1ae7ab7736e71ce5752955dc58da18310ebb8c

  • SHA512

    cc0abf50d7895482459afe508f629b991636452e75c18687af58ab2bd49f534f915444095cdc41083dfafbb0039d20593811c5e42a87bcf6dea5ca86343d1dff

  • SSDEEP

    3072:5HpUtgn7enHtDeA6f2hWKfLHXSsSJbgvLJJmZiGEnbogtY9swiQlDVKf:5HL7eN6f2hLTHXSnEvVUiGw69swDx

Score
10/10

Malware Config

Signatures

  • Detects PlugX payload 15 IoCs
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\841dfe3eaafe68cc0b989fbf55a34c9c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\841dfe3eaafe68cc0b989fbf55a34c9c_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\SysWOW64\msiexec.exe
      C:\Windows\SysWOW64\msiexec.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/808-14-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/808-1-0x0000000001E40000-0x0000000001F40000-memory.dmp

    Filesize

    1024KB

  • memory/808-4-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-16-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-18-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-15-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-30-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-17-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-19-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-20-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-2-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-38-0x0000000001D80000-0x0000000001DAE000-memory.dmp

    Filesize

    184KB

  • memory/808-32-0x0000000001E40000-0x0000000001F40000-memory.dmp

    Filesize

    1024KB

  • memory/2544-21-0x0000000000110000-0x0000000000111000-memory.dmp

    Filesize

    4KB

  • memory/2544-28-0x0000000000430000-0x000000000045E000-memory.dmp

    Filesize

    184KB

  • memory/2544-26-0x0000000000060000-0x0000000000061000-memory.dmp

    Filesize

    4KB

  • memory/2544-25-0x0000000000430000-0x000000000045E000-memory.dmp

    Filesize

    184KB

  • memory/2544-29-0x0000000000430000-0x000000000045E000-memory.dmp

    Filesize

    184KB

  • memory/2544-27-0x0000000000430000-0x000000000045E000-memory.dmp

    Filesize

    184KB

  • memory/2544-23-0x0000000000130000-0x000000000014B000-memory.dmp

    Filesize

    108KB

  • memory/2544-35-0x0000000000430000-0x000000000045E000-memory.dmp

    Filesize

    184KB

  • memory/2544-24-0x0000000000150000-0x0000000000152000-memory.dmp

    Filesize

    8KB