Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 17:49

General

  • Target

    a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe

  • Size

    117KB

  • MD5

    a79f2947edc9daf185253fdd3dee4f74

  • SHA1

    75abfcd09f0076697f58ccd02f3ed22f2e501cee

  • SHA256

    725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22

  • SHA512

    c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4

  • SSDEEP

    1536:uzpoGDl31C8f6SOvaLzX+aXGrj9KABF9SPRFHquxMJOjvSaABsDAwvpKbKQ7LGuS:if6SOozOaXGrjdSP9EaA0ByKQ7Oj

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\Fqobua.exe
      C:\Windows\Fqobua.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Fqobua.exe

    Filesize

    117KB

    MD5

    a79f2947edc9daf185253fdd3dee4f74

    SHA1

    75abfcd09f0076697f58ccd02f3ed22f2e501cee

    SHA256

    725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22

    SHA512

    c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4

  • C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

    Filesize

    372B

    MD5

    d283758972a8909edb6e0103b8fff004

    SHA1

    9f31452b21b6efec39cdb6ab8d05491b5b3aa8ce

    SHA256

    6e38f9ab7a3ffa78edf8fb30062df1be5dcf540fb89e438a76386efcd810cf47

    SHA512

    67e757315a53c758280c32217f1b84663b0ac34d1e8266b6805fcc8ca80bf339f8333fa723eccdf16b6759d4bf7403e5a93f2e241ef9864772dfe04ec7aee404

  • memory/2140-45491-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-45498-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-10-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-11-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-45494-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-45487-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-45488-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-45493-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2140-45490-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2356-26949-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2356-45489-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2356-0-0x0000000000230000-0x0000000000248000-memory.dmp

    Filesize

    96KB

  • memory/2356-1-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB