Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 13:59

General

  • Target

    8aa247c559e55f09c2b784e1b6ad110b_JaffaCakes118.exe

  • Size

    650KB

  • MD5

    8aa247c559e55f09c2b784e1b6ad110b

  • SHA1

    2e3441da3562bc104cce5324eea82d3904ef9542

  • SHA256

    4d31a323ca23029aac338fa7a75b2a1c74ffb84aa76235b3565ad7c092e9f74d

  • SHA512

    570cf797c299bc9b0d11eefdaad741668f45cd477e094f1e0066338a008b65150500de847f0711ca9079bfb1ccc3181212b4a425e6ad9dffb7cf8eaec6a583e4

  • SSDEEP

    12288:p81Ed0hYcVhG6P32wykQzIin355k2GVpSx697YZRRy2OsNdNs:p81EdVcVc6Pg+pSxGYzR5rm

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8aa247c559e55f09c2b784e1b6ad110b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8aa247c559e55f09c2b784e1b6ad110b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\Temp\adobeupd.exe
      "C:\Windows\Temp\adobeupd.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:272

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\Temp\adobeupd.exe

          Filesize

          1.4MB

          MD5

          8c0a7fcce648ba9908f4226cbf54cc55

          SHA1

          827f34ff32cdf64b99b6dcfb0a1ebf3e0b91eb85

          SHA256

          34cf73ea15efe98dbe1a35392f68e4c132bb672a14512450587454bba826c4b2

          SHA512

          776bfd0f609d76211d79acee90cd775ad28ccec26eeb481bbefb1f7241a68b48687a71ed3c284aa83211db8dcc0ea44bc64d48cc2643e212638e508bf11462f5

        • memory/272-7-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/272-8-0x0000000000400000-0x0000000000566000-memory.dmp

          Filesize

          1.4MB

        • memory/272-10-0x0000000000400000-0x0000000000566000-memory.dmp

          Filesize

          1.4MB