Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2024 06:15

General

  • Target

    a9e8d1a30c8e2fd5c48f17000aa814c6_JaffaCakes118.exe

  • Size

    163KB

  • MD5

    a9e8d1a30c8e2fd5c48f17000aa814c6

  • SHA1

    df407372fa427b3444bd52d47db4c2ce4f255c99

  • SHA256

    bf81d34d57b3fd15de4f92dd416fca1d6700824c73370beb5eddc4c766ec0efe

  • SHA512

    fe367a193b718dc51f23fd37af41a557f403b704d139a8ae84fdf4c3fa2c73edbf8fc0a16b8fb24fd3aacb670b38526b8d00edc60a811fe0adbc9980af7e6844

  • SSDEEP

    3072:lb9HdEgnc29JuB/RVgU974KlGro2UWQRtgxC6c3ovNRdNUirqSmF7Nv5D:l5HXbmVJ974KlGM/g46cYVWimF7hV

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9e8d1a30c8e2fd5c48f17000aa814c6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a9e8d1a30c8e2fd5c48f17000aa814c6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe
      "C:\Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2680
    • C:\Users\Admin\AppData\Local\Temp\a5.exe
      "C:\Users\Admin\AppData\Local\Temp\a5.exe"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Users\Admin\AppData\Local\Temp\~25947822.exe
        C:\Users\Admin\AppData\Local\Temp\~25947822.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\QvodSetupPlus3.exe

    Filesize

    149KB

    MD5

    a3de6c880f4fbe1c2fdae63bed2587c5

    SHA1

    d24408ca4349f83b66409e773fab10863469a1f6

    SHA256

    eae20a59c483e08d98b03e9367af8069ae78133240f0ad73077db1f5f63c1e39

    SHA512

    218523a61e1cb2da1e2f92170965bcb51f3dc006365be606cd3d19fe8abe54c6c59674c161febdeacdc0fa8974a5ed1bfe00471c1762184026646cbc9881d12e

  • \Users\Admin\AppData\Local\Temp\a5.exe

    Filesize

    27KB

    MD5

    0384f7bb7c11478a49daa7bf8835b350

    SHA1

    4e03775afcf603a7fa8826780b28ced3dc973114

    SHA256

    ef08c323945e892f2effe7f798c37e097ce298b5d84d14fb91f0f7c59b4e6b3d

    SHA512

    2559884a2e88ba7a9136554d151d364aede5b07da25b2a06996b528402edd37f37c8ba362484c35e5a693cd012dc23b0373cc178cbbd877fdc56832a837ee4b9

  • \Users\Admin\AppData\Local\Temp\~25947822.exe

    Filesize

    8KB

    MD5

    b982364e53855a6963f2753fc5fc084f

    SHA1

    b66c7dda9ae97712b0640bfba61ca15e23bc82ec

    SHA256

    c81d315f80e8b3207e9391298263fae8651046576fc2a652e26d744fe5227763

    SHA512

    d06f3b6000a4e342773435e9b96818614af4da3a8c2b692e1d5cc994d18c68872858cb09fd36bca3158ab863efb31e89421866f4c99d6f863b8d593db0adfc7e

  • memory/2644-18-0x0000000000400000-0x000000000042A719-memory.dmp

    Filesize

    169KB

  • memory/2644-5-0x0000000002440000-0x0000000002497000-memory.dmp

    Filesize

    348KB

  • memory/2644-0-0x0000000000400000-0x000000000042A719-memory.dmp

    Filesize

    169KB

  • memory/2680-27-0x0000000003480000-0x0000000003684000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-30-0x0000000000240000-0x0000000000297000-memory.dmp

    Filesize

    348KB

  • memory/2680-24-0x0000000000240000-0x0000000000297000-memory.dmp

    Filesize

    348KB

  • memory/2680-26-0x0000000003480000-0x0000000003684000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-58-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-28-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-19-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-25-0x0000000000240000-0x0000000000297000-memory.dmp

    Filesize

    348KB

  • memory/2680-31-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-66-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-68-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-45-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-62-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-48-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-52-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2680-56-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2824-29-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2824-46-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2824-32-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2824-20-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB