Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 23:58

General

  • Target

    ad1c750c41c84e6caec526393f26aef1_JaffaCakes118.exe

  • Size

    12KB

  • MD5

    ad1c750c41c84e6caec526393f26aef1

  • SHA1

    ea4b0fe24408947e02ea24aabf16f2591f7f80f3

  • SHA256

    a3457113f6098ee793514866c6a3ecab7ef10a81e1d965178add997aa16b2573

  • SHA512

    72b3e51d5bcccd09515265c0489ea3c9ec8619d6f18479658cea73f05fbed6d8e128f98cf338580244018a6665740aa2e235093bbe24c121c73e76f3e0729bc5

  • SSDEEP

    384:xc+jY2ZNii+YANVkZpFbml++7U2KOY0Yf:e+jZ4NVkrFb4+4U2QBf

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad1c750c41c84e6caec526393f26aef1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ad1c750c41c84e6caec526393f26aef1_JaffaCakes118.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\B931.tmp.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\B931.tmp.bat

    Filesize

    207B

    MD5

    39fc204eeeefe50b6b878006d3e33ea7

    SHA1

    d355df03adcacd9c45123d966f19cf95f8281545

    SHA256

    45a1c18bc2d9fa8ed034242db7071259e69c50a79d307db0531e9c28f89b967a

    SHA512

    840b4daed3019fc9ee0acfd6b4a4319551f82cec6a33cf6f18f6fc0167976372438e8f1a5d42c52117fc154fb09ce0292c3ea7e1316a2daa30484935cab46c3b

  • C:\Windows\SysWOW64\mscxejhl.tmp

    Filesize

    2.4MB

    MD5

    108871d4c376f230317faa45fade55ec

    SHA1

    37802f5c9c4d22680abafcb7ef199471ff177705

    SHA256

    8211d0cafe51866e7bb1583a995f867357c45e29f902991b67398adbaf00f116

    SHA512

    b0cebf11f1c9744eb302ba8e7c4962dcea2847e07fc6e1c1730d6d0dc78c2afb67e15fcb893986620c60bb2f9f96d979e6e0dc3499db1bbc002291afd7f58074

  • memory/3044-12-0x0000000010000000-0x0000000010007000-memory.dmp

    Filesize

    28KB

  • memory/3044-21-0x0000000010000000-0x0000000010007000-memory.dmp

    Filesize

    28KB