Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 04:47

General

  • Target

    ade8b7109491a576ef9e33c6ad175e3d_JaffaCakes118.exe

  • Size

    297KB

  • MD5

    ade8b7109491a576ef9e33c6ad175e3d

  • SHA1

    5ce75d4b306c42d294c33c3b76a6723c62544a33

  • SHA256

    ffbd31ddd22c2abf5488b073474c61454f7bf6deb10260b7551245faf5e934e8

  • SHA512

    dc0dce9c9af62dd5f60a0ad070e09c5dff1b85794e4c99096711dfad3c4144036d315c7ba50ff82bc22d02a658ba37f1823256b4334f86c3b0306ceffd485f38

  • SSDEEP

    6144:WjhawZHWSIg118HWULKjC7hif1mO45x3VN0cp0cyIi:yljIaC7hy45x3ko0cyIi

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1284
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1388
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1444
          • C:\Users\Admin\AppData\Local\Temp\ade8b7109491a576ef9e33c6ad175e3d_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\ade8b7109491a576ef9e33c6ad175e3d_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:828
            • C:\Users\Admin\AppData\Roaming\Xyobw\mileh.exe
              "C:\Users\Admin\AppData\Roaming\Xyobw\mileh.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of UnmapMainImage
              • Suspicious use of WriteProcessMemory
              PID:2240
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp8ed68206.bat"
              3⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:2132
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1604

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp8ed68206.bat

            Filesize

            271B

            MD5

            a230b188d83d366e04eaa5416b77cdd6

            SHA1

            92d9822b74fac595ab785de577b5a1e006525d9a

            SHA256

            8421f47c2379e3afd967dda3bac56480973fc85cce510307c0b308c890c32e39

            SHA512

            d1b7017334f9d0ea58051c4b94b862a0c83e58d10d2e552510138c1598196751ff653d4c31a4b7cb124e2044f287b59e82c1e3bffef1780178a985510449ed47

          • C:\Users\Admin\AppData\Roaming\Ojuv\ybfa.tye

            Filesize

            380B

            MD5

            d4bc7f35aefa7a875f8406f777e293d0

            SHA1

            3f78896442d9bd2494c9bc8ac27d3a34c30ecb82

            SHA256

            006fd70a01f780affd78b9a448f7e6b9c877bee3f334a0f67b2809493725707a

            SHA512

            146d17006dc4bd0ac43d761a5a0b8257893c96ad7db721bc1a488528a5ea31582c444a11b3a20c2cc9e1e6f6b7265692d52cd8413a935c51b8374db27fb1a778

          • \Users\Admin\AppData\Roaming\Xyobw\mileh.exe

            Filesize

            297KB

            MD5

            e9f5187c76f1bd2d757a79b00a29dc75

            SHA1

            d57cf0e668c9d9c477326d76747e79a80161c056

            SHA256

            76a982a5c1a5dcfb0c7aa9946f44193d797e92b037fa9b3856ea6a5d1e6f6709

            SHA512

            893b6f51ee751753893a955875baf5152099d6edcbfa0476f2322db4181800e241448dbe047b5041ae6c85f1e08ad62582c53cad8c069145e33723439834b05f

          • memory/828-67-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-140-0x00000000004C0000-0x0000000000501000-memory.dmp

            Filesize

            260KB

          • memory/828-7-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/828-4-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/828-2-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/828-1-0x0000000000460000-0x00000000004B8000-memory.dmp

            Filesize

            352KB

          • memory/828-166-0x0000000000460000-0x00000000004B8000-memory.dmp

            Filesize

            352KB

          • memory/828-167-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/828-168-0x00000000004C0000-0x0000000000501000-memory.dmp

            Filesize

            260KB

          • memory/828-0-0x0000000000300000-0x0000000000341000-memory.dmp

            Filesize

            260KB

          • memory/828-57-0x00000000004C0000-0x0000000000501000-memory.dmp

            Filesize

            260KB

          • memory/828-56-0x00000000004C0000-0x0000000000501000-memory.dmp

            Filesize

            260KB

          • memory/828-141-0x0000000077B50000-0x0000000077B51000-memory.dmp

            Filesize

            4KB

          • memory/828-3-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/828-142-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-79-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-77-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-75-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-73-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-71-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-69-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-65-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-63-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-61-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/828-60-0x00000000004C0000-0x0000000000501000-memory.dmp

            Filesize

            260KB

          • memory/828-59-0x00000000004C0000-0x0000000000501000-memory.dmp

            Filesize

            260KB

          • memory/828-58-0x00000000004C0000-0x0000000000501000-memory.dmp

            Filesize

            260KB

          • memory/1284-27-0x0000000002030000-0x0000000002071000-memory.dmp

            Filesize

            260KB

          • memory/1284-25-0x0000000002030000-0x0000000002071000-memory.dmp

            Filesize

            260KB

          • memory/1284-19-0x0000000002030000-0x0000000002071000-memory.dmp

            Filesize

            260KB

          • memory/1284-21-0x0000000002030000-0x0000000002071000-memory.dmp

            Filesize

            260KB

          • memory/1284-23-0x0000000002030000-0x0000000002071000-memory.dmp

            Filesize

            260KB

          • memory/1388-31-0x0000000001F80000-0x0000000001FC1000-memory.dmp

            Filesize

            260KB

          • memory/1388-35-0x0000000001F80000-0x0000000001FC1000-memory.dmp

            Filesize

            260KB

          • memory/1388-33-0x0000000001F80000-0x0000000001FC1000-memory.dmp

            Filesize

            260KB

          • memory/1388-37-0x0000000001F80000-0x0000000001FC1000-memory.dmp

            Filesize

            260KB

          • memory/1444-42-0x0000000002800000-0x0000000002841000-memory.dmp

            Filesize

            260KB

          • memory/1444-40-0x0000000002800000-0x0000000002841000-memory.dmp

            Filesize

            260KB

          • memory/1444-43-0x0000000002800000-0x0000000002841000-memory.dmp

            Filesize

            260KB

          • memory/1444-41-0x0000000002800000-0x0000000002841000-memory.dmp

            Filesize

            260KB

          • memory/1604-52-0x0000000001F30000-0x0000000001F71000-memory.dmp

            Filesize

            260KB

          • memory/1604-46-0x0000000001F30000-0x0000000001F71000-memory.dmp

            Filesize

            260KB

          • memory/1604-48-0x0000000001F30000-0x0000000001F71000-memory.dmp

            Filesize

            260KB

          • memory/1604-50-0x0000000001F30000-0x0000000001F71000-memory.dmp

            Filesize

            260KB

          • memory/2240-15-0x0000000000330000-0x0000000000371000-memory.dmp

            Filesize

            260KB

          • memory/2240-16-0x0000000000380000-0x00000000003D8000-memory.dmp

            Filesize

            352KB

          • memory/2240-17-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2240-286-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB