Analysis

  • max time kernel
    136s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-08-2024 06:17

General

  • Target

    b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe

  • Size

    126KB

  • MD5

    b6a225b4d7e337a4a23be5cb588b0611

  • SHA1

    36fa48acca39a6aaf51259e9365a68dc89407295

  • SHA256

    919b5fd2a8bda40202bbdd2d44202bd52ee0e104a85cf50dbf315ac64ea1558a

  • SHA512

    e7b8be081d13f79826b155f6b14b6e64df87f4af617d771d0eaf8935b18ebe17a528bc7a5b98dc651ef8eb29b03424c64524dbee2bcd5a2d8e58d8cdddde25d4

  • SSDEEP

    3072:bgXdZt9P6D3XJNHXE0Kbh5FXUcE6rF6tcBp/:be343HXEV06rF8Eh

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3596
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy8369.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    eef9e469e8a30717974499f277d97e2a

    SHA1

    2d33c25984ebd9116beeb55cdde4c5c86c023e5d

    SHA256

    1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

    SHA512

    d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

  • C:\Users\Admin\AppData\Local\Temp\nsy8369.tmp\ioSpecial.ini

    Filesize

    580B

    MD5

    a38db643b7954a75bce5f2cb9bd39697

    SHA1

    5303c78100d9f15a46845ec0cb98c61e2f08e192

    SHA256

    ee544a55dcdfb72950d384b1c22a88a7518abeb8b1c29a4029185412cf21c5fb

    SHA512

    f49cedc51a285cae333127ab69967a11186fddf11702237f21b4e2898a00f978b330d2835fea28003bdd24970c0551dfa458a47047d64ae98efaa989acad49bc

  • C:\Users\Admin\AppData\Local\Temp\nsy8369.tmp\ioSpecial.ini

    Filesize

    619B

    MD5

    875e26f9fbbc31442bc2d584bdf8232d

    SHA1

    10a6d229c98b362ac7f424f18fa7eb8ffae4bc02

    SHA256

    7db88bcd9c841974a02643ce12c0497393c26b7ffddd035037aded75241b71fe

    SHA512

    5ec814ce8573ea90d5aeb0100ef976e862e7ace326149df330bf988502834d374f0139ce5fe4718f703306c6a0ac56b36c0587dfd42d23e1fd5badf14b8837bb

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    126KB

    MD5

    b6a225b4d7e337a4a23be5cb588b0611

    SHA1

    36fa48acca39a6aaf51259e9365a68dc89407295

    SHA256

    919b5fd2a8bda40202bbdd2d44202bd52ee0e104a85cf50dbf315ac64ea1558a

    SHA512

    e7b8be081d13f79826b155f6b14b6e64df87f4af617d771d0eaf8935b18ebe17a528bc7a5b98dc651ef8eb29b03424c64524dbee2bcd5a2d8e58d8cdddde25d4