Analysis

  • max time kernel
    140s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 19:51

General

  • Target

    b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    b4cf2d93bab4987e99b6056cc1c2f613

  • SHA1

    9e453855d6000d5c8a192eebcfcda0b3eae05a92

  • SHA256

    9826c56553310f47f1c93419870ed935cc92b00cec23c7b0e04a275c00093c78

  • SHA512

    b4e875f01dbfc253e2ddeac35c81756cbabf8121d521d1e6b183f8af21cdd56157c18be97ae312c70bce162d167b8dd46b3ef474e38b610b5839b046ae493db7

  • SSDEEP

    24576:xIqpr552da20BSeveKyTiOxOlO07paHd7G:bFwd0fvKZxOxF2d7G

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe
      "aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe" "C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\index.html"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\data.js

    Filesize

    40KB

    MD5

    f719a0f4fbdc6adcfaf69d5234dc132a

    SHA1

    282f239f5f5adfb9651bb690e611085b9a5a7f80

    SHA256

    4dbca5cf6f59d12ad106479b05ef5c1a0638b87e0e5fd971d29a203f1b47a74b

    SHA512

    a562f1cf0e36a2fa9dc332fade15b46959f78fd22769a9cf842fe14f289cbd8e8fb69b46c65f9e04b98fe48e3846e3401637c636510e0d9344b591f1baa3beaf

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\data0.js

    Filesize

    244B

    MD5

    13cf1e437106581c0cbd7a8a560918a5

    SHA1

    ad9f44433a71cfc0ff2f5e5dbe64053a0ec943e9

    SHA256

    d8ae1a18a8e51963dafd8eac17194cae91f785d469f2653df8daff12ef027c15

    SHA512

    b3a3b489dffd0c6245cefd24a16eceed455be5e073d72e30ab948d9b8a22bd3254818f422b65a8803bc83389bdc2ff7f95afb615dd24567c39e07501cd7d3b6f

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\img\0.gif

    Filesize

    5KB

    MD5

    e99c30a014f2c52366a8b460553ce982

    SHA1

    6177a9c60e1027e908a4019321570992729ee7ef

    SHA256

    e5dc8cc6f456ed8a36923946f962c04a38c13da21654d8977acf3012a2ec3bab

    SHA512

    b4ac564f1fc728526277ac2fde64c56b6a5f3bc69e71a68a8688cc1f0fbecdd7e30b28219862864adf0028c770ee44ce74e6f509ae5759023cc286b2d5e9189c

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\index.html

    Filesize

    489B

    MD5

    263e7937ad144efa91dc45e29a4238c5

    SHA1

    baab29f7377b9bd43175d6e6cf0a7e317f3f3e48

    SHA256

    b5f7d03b8819dbcef07a1cb98522e76e5f89770519cfca0d7799f711a579f7a5

    SHA512

    1308bd31e98a67ca909a96ad46858bc5ff51774b88ea5934495dfe1bfd8312bfd86d0d01adb1cc4027a4bb15dc9b5e9965f45ba860eb25ec4d489e16b68014af

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\css\formcontrols.css

    Filesize

    4KB

    MD5

    ceb254db6626fa437a395e52d2c11da2

    SHA1

    74c224224b7f8ffd209bf346cbd133e04655cb3a

    SHA256

    5bab3a570e5e62cac658996a5db974b43a0a932d51ddffcc5e437ebd33ba0d39

    SHA512

    625ca3564e7eb48e178f1440cdbb69c51e9fb21086f4eef8d210462c83de2a171dd4789f821687f9b877682532d05c1418b5e19f52f7bd94c039ea90ab93ab5e

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\css\layout.css

    Filesize

    453B

    MD5

    9565c38ee56f996aac2fb0906cc1882c

    SHA1

    95ee88fca47973c939454d98bb8784f7082a8613

    SHA256

    ac068ae6094a331acc49424d65e4c986f5e1a15df077476edbf38dd0de4817f8

    SHA512

    75fbd81bed85a46e5da6a7c589e3ef12a9fdb6578dec95d0aea8f99af8e94440e7edcfdab8e15d87471b7a6d1dab53c293b466dedb1ca4778bf0fe1d25b9efc4

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\css\main.css

    Filesize

    2KB

    MD5

    f831bb398578407ecfb03ac2ac12a725

    SHA1

    b4ccf4aa0ac4f796e5d4f0f7e1f5004c1173c31a

    SHA256

    ed577dffdb0291e142ff6d1c4a00d03d0c98482ee5c3fc12ed7585a19e2300a9

    SHA512

    2643a6386e2f80b678d2d66258486d63e66975507aab382f1564804bc02630792316c2d57dbd8849b107e8e24a9c05352633bedeb65c82553e13e6827a5cd48d

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\img\button_normal.png

    Filesize

    148B

    MD5

    ef78dfa76fe087a66d8ebfa34c5f7b9e

    SHA1

    8d62509ae458125e3e3fdde063cb653b65b4d13b

    SHA256

    a0a7b4fdde3e8b5c538d4506f4dac85f4794f5cfbba29397719ae170c57cefdd

    SHA512

    b586ba703aaf592f91a29cc8ef23b5ff7fd4e19baf0f344fe16bbdb7a1689eda831cdf69877225859a95be2efe76a52b5e2de28d1fd3dcb5959cbbd4d04b0112

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\img\hr.gif

    Filesize

    43B

    MD5

    16616cf0c229b6b1e817a68c732cf889

    SHA1

    4f5b2f8372dcc50071491613eb75b04f57f529ee

    SHA256

    a5701c519fef62adb3e854ddf459d62a1a79c0610071b056a2cace8532a92205

    SHA512

    ddbc1f1a869bd76bbe9284f7825acaa0417285123b3085ac69b241a6eadd1d8b8993f669955952d7b9b6afbc0f546dd2308acb540469ff7b15310543c91337b9

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\js\app.js

    Filesize

    124KB

    MD5

    35c8675b6f9aab03082a91e29017e954

    SHA1

    c89a743eb67ffa2325cc40c01d3c87558a639235

    SHA256

    dd56b36a03e6ef0cba30ab2f9f37072f4a2e44a229ae3d6b8ff4c1546914fccf

    SHA512

    a9c0382967613cf136f863d83cf8dce9a6c8d9c840bf263b7782fbf377e1940a2fb36a330ad307ba719f879564cd7ce296c102b71918ccd84cd3f27b68c5c327

  • C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\web\js\formcontrols.min.js

    Filesize

    5KB

    MD5

    3c283c0123f825bbe0452dd02db776d3

    SHA1

    b77d2f2adcdda5fd666df6e240bcdc35e61b2ff5

    SHA256

    2b03ddbc59d18d890261bab13cab3613235607745508018cb8227d0153e79f57

    SHA512

    bbd6760481660edec51220235f6e656d232a0c98d8197616a105ea1d149d83dfc0b70268e96d606281bd5744de56bced0eae3931e46a2cf8c6eeb8659183d783

  • \Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe

    Filesize

    628KB

    MD5

    dffd68ca4cbe112f5fd55f3e1bd1f9c8

    SHA1

    7d6f3584cd910dd2cbc1b65ea8105d35b65e9db4

    SHA256

    b5ba6297685da0e59bf66e0557f1d3ded2c51211a8392de55c4bfe7896fc279d

    SHA512

    6529472c62a8cd0255676a1d32c28c4b9c45d5369f4973ca4357af220e0c1df1ef12cfb80414d2f273350f4a1c3c0f55b4074729a8a2629a343a5d9f91a98a7d

  • \Users\Admin\AppData\Local\Temp\nso3A44.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • memory/1068-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/1068-64-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2464-38-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/2464-67-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/2464-66-0x0000000000400000-0x00000000004A3000-memory.dmp

    Filesize

    652KB