Analysis

  • max time kernel
    147s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23-08-2024 20:02

General

  • Target

    bcf7b113032c1b7b7cbc0eb4d601ff34_JaffaCakes118.exe

  • Size

    109KB

  • MD5

    bcf7b113032c1b7b7cbc0eb4d601ff34

  • SHA1

    973344b931cb98974f79afb2f123774c64364e39

  • SHA256

    3f0d206fce405064db74b495134cdf7f376500c48a5260ffc52627efa9d5588e

  • SHA512

    75c4724b71a29bdb7d4a70be5852e41dda8724a8d034d57082551ec1c1d6eebcc77370ff361320ce030399db506a18e9b5e66250df0cd1c01d3aa31ac16dcce3

  • SSDEEP

    1536:Qnqdu3abBGy3G8V0iuoKWGq6KfFkWGq6cjTA:QqhMPsKWGqFdkWGqzjTA

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 34 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 36 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcf7b113032c1b7b7cbc0eb4d601ff34_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bcf7b113032c1b7b7cbc0eb4d601ff34_JaffaCakes118.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\bcf7b113032c1b7b7cbc0eb4d601ff34_JaffaCakes118.exe 
      C:\Users\Admin\AppData\Local\Temp\bcf7b113032c1b7b7cbc0eb4d601ff34_JaffaCakes118.exe 
      2⤵
      • Executes dropped EXE
      PID:1812
    • \??\c:\Documents and Settings\Admin\Application Data\Microsoft\scna.exe
      "c:\Documents and Settings\Admin\Application Data\Microsoft\scna.exe" bcf7b113032c1b7b7cbc0eb4d601ff34_JaffaCakes118
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \??\c:\windows\SysWOW64\maxtrox.txt

    Filesize

    8B

    MD5

    24865ca220aa1936cbac0a57685217c5

    SHA1

    37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

    SHA256

    841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

    SHA512

    c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

  • \Users\Admin\AppData\Local\Temp\bcf7b113032c1b7b7cbc0eb4d601ff34_JaffaCakes118.exe 

    Filesize

    27KB

    MD5

    9dbb82fb602aa42b131c55c5d136dc9c

    SHA1

    4f6d5c48f68b4a94b08960788b4660b8f6cf318d

    SHA256

    ca656fda1f8fea01307a97156e105792a40eb2e1968c057643f4bb21e81738df

    SHA512

    b1f5c52b7e7590625161bbe2f53dfd95bed88ab37b5ae31736c087f61e3b6a449bd782a18f028d869ac2dd9052f4d16254d89f746040f02f1608b5e5cad61328

  • \Users\Admin\AppData\Roaming\Microsoft\scna.exe

    Filesize

    82KB

    MD5

    71c51c1aac1ef3291695a0c71243f94e

    SHA1

    76bd9a9984417facb4377796fa2022228d648c61

    SHA256

    d98d13a6513b1b7a84c01da749634fd7689da7bc8eb1a1e429ee26e8107676ef

    SHA512

    400938ab594119132ff5230ca6ebd689eed7b5f1606ebcf65bf13391c176ebb7214a7582e5470c03ed59727dcf0695f0cdeadb03acff7160bd36a68238dc0585