Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23-08-2024 22:35
General
-
Target
bd6e80a157f36680184eff16db827de5_JaffaCakes118.exe
-
Size
173KB
-
MD5
bd6e80a157f36680184eff16db827de5
-
SHA1
9ab9eba21c522638973e606233b2a9ac253b1005
-
SHA256
2dfd24911df71284d1d661f2b88b222c1e9e00f97b48b02cde9876908a67cd98
-
SHA512
8b96cf866dca774e5d25d7d38d1002baecc95feaeb73e16bc160d554cb47cd2992b76c91a4c962ac67eab839b76308baf777cf3e9fcc9389aa1f352ac3c900d6
-
SSDEEP
3072:l4jg7Y+U+jUXQuXxp8HGlmEKuJn5CKYzOhNA/s3GM+VvCfl1BLgGIczjx25yZB22:le0UXQuXj8mMoJnkz6NMFMJpgGIOU5Md
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd6e80a157f36680184eff16db827de5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd6e80a157f36680184eff16db827de5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\IEXPL0RE.EXE"C:\Windows\system32\IEXPL0RE.EXE"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SVCH0ST.EXE"C:\Windows\system32\SVCH0ST.EXE"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172B
MD5f1a331bd21e751d17e18c493e559906d
SHA1297d8b55fe35594151ae10993aa391b23432c1d0
SHA25651e6e99482070e04c4ba403916871079b3f3c4fabcb0374a530dffa6032e8de1
SHA51231565cfaff1c25898db95f2fd819c19d619ca5af2ebf8f228108091af3f8503547b5b8d186da2fa5b23161f356b8c7b2d6d953e2a619f3341c102d20d1ed5602
-
Filesize
173KB
MD5bd6e80a157f36680184eff16db827de5
SHA19ab9eba21c522638973e606233b2a9ac253b1005
SHA2562dfd24911df71284d1d661f2b88b222c1e9e00f97b48b02cde9876908a67cd98
SHA5128b96cf866dca774e5d25d7d38d1002baecc95feaeb73e16bc160d554cb47cd2992b76c91a4c962ac67eab839b76308baf777cf3e9fcc9389aa1f352ac3c900d6
-
Filesize
37KB
MD5f16dac5333fdcb27b1f2ce6d2888a884
SHA1e181f7611948f7ed40568109eb1a2d7f988ad502
SHA2562f04746f12c5fcf5381688423accfc9f1d3ff2f73b1c829a164d8591815b448c
SHA512d347caba4b5dbdccaff8ccedd91314bac8b758bb37c3d02a81fb80c2b20dece51a40b809ec6d6d33becbaa3b098c34fd0c0bd7b3e1c868c4f8943be5f3788973
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
4KB
-
Filesize
612KB
-
Filesize
160KB
-
Filesize
612KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
612KB
-
Filesize
160KB
-
Filesize
160KB