Analysis

  • max time kernel
    137s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-08-2024 22:31

General

  • Target

    a46551c1bdab3a0c923503e7fa16778f_JaffaCakes118.exe

  • Size

    219KB

  • MD5

    a46551c1bdab3a0c923503e7fa16778f

  • SHA1

    602813cb29471b62dcd8da065a7fa872a523a6d5

  • SHA256

    1e0ed721040c2e3d63c845ac6d932eff5162d3a6eb24689e687cae30985951d9

  • SHA512

    e7185b53674002f742810d4cb0f858f3e0f8c65fc89ae62ed049d2dddc61b43c3e5a7f722843e08d672c953ef88bfc7afa453af8a17d71925b85182491b5d7c3

  • SSDEEP

    3072:Zk6/SAnzOr3uP7qoArkUh//ko1ccfCTR9gjOIA4pWC:C6/zKiPUNT1cACTfgjd1AC

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ***098***

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a46551c1bdab3a0c923503e7fa16778f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a46551c1bdab3a0c923503e7fa16778f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\b4bri0x3.4d2
      C:\Users\Admin\AppData\Local\Temp\\b4bri0x3.4d2
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b4bri0x3.4d2

    Filesize

    98KB

    MD5

    ee3ecec6bfddfceb2f7f30d91d41e360

    SHA1

    af568e09c2b6851b01e7e2002ffb76926bdf5502

    SHA256

    79ab62fbbd993ae858f19a6a7096c16979988dda150684bb3f8c6d380fee1ba3

    SHA512

    cae873d4a169067495c8981afedcb461d8afdf296ae7bbab58d4a7e64a5eb5040d911691acb82901dedb3bdc72e78ed8ce2b3843c890ee8d9ac2624c7211c76f

  • memory/632-10-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-26-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-3-0x000000001C380000-0x000000001C84E000-memory.dmp

    Filesize

    4.8MB

  • memory/632-4-0x000000001C8F0000-0x000000001C98C000-memory.dmp

    Filesize

    624KB

  • memory/632-5-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-6-0x0000000001780000-0x0000000001788000-memory.dmp

    Filesize

    32KB

  • memory/632-7-0x000000001CA80000-0x000000001CACC000-memory.dmp

    Filesize

    304KB

  • memory/632-1-0x000000001BD70000-0x000000001BE16000-memory.dmp

    Filesize

    664KB

  • memory/632-28-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-2-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-8-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-9-0x000000001DF30000-0x000000001DF92000-memory.dmp

    Filesize

    392KB

  • memory/632-27-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-22-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-23-0x00007FF9EFB95000-0x00007FF9EFB96000-memory.dmp

    Filesize

    4KB

  • memory/632-24-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-25-0x00007FF9EF8E0000-0x00007FF9F0281000-memory.dmp

    Filesize

    9.6MB

  • memory/632-0-0x00007FF9EFB95000-0x00007FF9EFB96000-memory.dmp

    Filesize

    4KB

  • memory/4528-20-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4528-16-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB