Analysis

  • max time kernel
    141s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 07:04

General

  • Target

    c033d79e12055651cdd5ce4430ac2352_JaffaCakes118.exe

  • Size

    112KB

  • MD5

    c033d79e12055651cdd5ce4430ac2352

  • SHA1

    65cabd012ee25df484be7c9b3706e69d69ac6361

  • SHA256

    aa929340559fdaf210875cb621bed63d133b0b9a80597d89adad0cd9d572ce01

  • SHA512

    aecb923bb4bf682d7efa8280836ff9322fb9c0e54f0c1633f94c2f6c12747d4074c36f8409da5e6ddb201cbf48036625346f845b2c3db97e8f99430866d1fd4c

  • SSDEEP

    3072:nQIURTXJ8eqgKJ+BCqCjTDmd7bRfsm0pHGGfs4:nsOgKPjfa7tfP0RGGfV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c033d79e12055651cdd5ce4430ac2352_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c033d79e12055651cdd5ce4430ac2352_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\downloadmr.exe
      C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\downloadmr.exe /u4e9422ac-75a8-4a0f-9b5b-46785bc06f2f /e2010929
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:2556

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsh8ADD.tmp\downloadmr.exe

          Filesize

          137KB

          MD5

          bbf2521f0924f66c7bb0d63cae2af0ae

          SHA1

          e8ebec5f73a4fa3c513611aa6b97ea3759c5d701

          SHA256

          62fd49a2104878f136e2247037c5ef9a73f6a78c4ca3a1cc38e1bfb80b108021

          SHA512

          0e643b8f2494acb366a030d33152eabe8c692ba3a39bb674ca9ff7f78f8f537d22110e613045581472003ce0d4f831ff487ee3e71b06635eee46a9b6a3fa4991

        • memory/2556-4-0x00000000747E2000-0x00000000747E3000-memory.dmp

          Filesize

          4KB

        • memory/2556-5-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB

        • memory/2556-6-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB

        • memory/2556-9-0x00000000747E2000-0x00000000747E3000-memory.dmp

          Filesize

          4KB

        • memory/2556-18-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB

        • memory/2556-19-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB

        • memory/2556-20-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB

        • memory/2556-21-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB

        • memory/2556-22-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB

        • memory/2556-24-0x00000000747E0000-0x0000000074D91000-memory.dmp

          Filesize

          5.7MB