Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 17:49

General

  • Target

    a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe

  • Size

    117KB

  • MD5

    a79f2947edc9daf185253fdd3dee4f74

  • SHA1

    75abfcd09f0076697f58ccd02f3ed22f2e501cee

  • SHA256

    725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22

  • SHA512

    c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4

  • SSDEEP

    1536:uzpoGDl31C8f6SOvaLzX+aXGrj9KABF9SPRFHquxMJOjvSaABsDAwvpKbKQ7LGuS:if6SOozOaXGrjdSP9EaA0ByKQ7Oj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\Afymoa.exe
      C:\Windows\Afymoa.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Afymoa.exe

    Filesize

    117KB

    MD5

    a79f2947edc9daf185253fdd3dee4f74

    SHA1

    75abfcd09f0076697f58ccd02f3ed22f2e501cee

    SHA256

    725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22

    SHA512

    c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4

  • C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

    Filesize

    390B

    MD5

    80ec751a70ee5b1b9a0db464dd033ee3

    SHA1

    370a2a733787f8eef2592cc66b26cc6b87ef3ee7

    SHA256

    4b54e0675a08b000dd43eb5b033427d9e2bae1e5a0361d4fa19358f52f570654

    SHA512

    d6866e4acc4d09330cf2a0407490541897b344652c26e0c51491e14c43abb48a34f9c806895c27ab9bc68a065c293e85515857e94b8e917b629bb4f02276d2b6

  • memory/3772-98588-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3772-8-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3772-9-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3772-42608-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3772-98589-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3772-98590-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3772-98592-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3772-98596-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4064-1-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4064-42637-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4064-98587-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4064-0-0x00000000004D0000-0x00000000004E8000-memory.dmp

    Filesize

    96KB