Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2024 08:38

General

  • Target

    89b4515a49376f92b7f52f668933422f_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    89b4515a49376f92b7f52f668933422f

  • SHA1

    aeb37965ae2dff6bba95d1ce60557420ba3dcd97

  • SHA256

    32f5cd068eed57f23fe3238b0adc8ce17bd60166f69e74406f2a1523b16de16f

  • SHA512

    af2cb1c883f40720379a69537724c08d5413e4dc74bd78f975d5dc8bee0dfe31048caeaedf76ded18a4fc65014ba6e1120de520a7b7de923c02eb5d2e58fab1e

  • SSDEEP

    6144:CYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew2fPDZj:CSNC80I+cR3R03Vse5fPDZ

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89b4515a49376f92b7f52f668933422f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\89b4515a49376f92b7f52f668933422f_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C AT /delete /yes
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Windows\SysWOW64\at.exe
        AT /delete /yes
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\SysWOW64\at.exe
        AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\autorun.ini

    Filesize

    109B

    MD5

    43b9dfd6e61eba0dda808ab0f5f966aa

    SHA1

    ffdca1842198d91dae7c98e862704ea80235894b

    SHA256

    de6a46a45c6fb7c6e3ef68bba4d706b2f398dc961fbdbd2b23a5067c5faff406

    SHA512

    40f1c2597ad182c5e4c2fd6e3bf63e5683f1f9acdd3021eaee5d7c20f39dfc525736bd73ad7955a770b23ce1eb419a3c346095b31573bb9aea9558fd07494981

  • memory/3856-16-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-15-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-11-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-12-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-17-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-14-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-10-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-0-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-13-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-18-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-19-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-20-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-21-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-22-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-23-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/3856-24-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB