Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 07:12

General

  • Target

    89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe

  • Size

    391KB

  • MD5

    89772395aa928df51294bfc6677c40a3

  • SHA1

    0ce32f7154e23dd42884fdbad20d806c5ae805f4

  • SHA256

    12ea01ce147d3b43d424959fcf23b486642c7449b8646cd00c3cbf52938a7342

  • SHA512

    79b36e0dad6fdff3b57b9aa4b469b7df2b9ce8dc3c4d34ae77378f638d7cae85f8ea05731967a36d75f5dcf565f5fb575e4f2fa0a36321eae2fa4e36ba19e716

  • SSDEEP

    12288:ue5/Qk/ufkK5UcHYc8Y5cLKLopYW9zOt11S5q:uY/NuDmcHY5Y5CKLoiG+j

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\89772395aa928df51294bfc6677c40a3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\windows\SysWOW64\windowspowershell\v1.0\tnhfk.exe
      "C:\windows\system32\windowspowershell\v1.0\tnhfk.exe" /i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\460abea9.log

    Filesize

    128B

    MD5

    2e512a2c0dde18eda81d412661703293

    SHA1

    bc5b4988f3bde0ed5ae15895bb9b8b282005c013

    SHA256

    4def40399db064c5819a25b510d638c719132a55bee260a949cc19f306a988d9

    SHA512

    2485582e04930fec807d8731b3743a81b28f647be13b172ea35aa2fa3e0e1bd0cd14d7bce94d350286059915a5395cf57eb062ac7ef838e9111181ea009bd5e2

  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\tnhfk.exe

    Filesize

    391KB

    MD5

    89772395aa928df51294bfc6677c40a3

    SHA1

    0ce32f7154e23dd42884fdbad20d806c5ae805f4

    SHA256

    12ea01ce147d3b43d424959fcf23b486642c7449b8646cd00c3cbf52938a7342

    SHA512

    79b36e0dad6fdff3b57b9aa4b469b7df2b9ce8dc3c4d34ae77378f638d7cae85f8ea05731967a36d75f5dcf565f5fb575e4f2fa0a36321eae2fa4e36ba19e716

  • memory/2752-19-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2968-0-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2968-1-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2968-4-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2968-15-0x0000000002E50000-0x0000000002EB3000-memory.dmp

    Filesize

    396KB

  • memory/2968-14-0x0000000002E50000-0x0000000002EB3000-memory.dmp

    Filesize

    396KB

  • memory/2968-26-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB