Analysis

  • max time kernel
    142s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 09:16

General

  • Target

    c06b57795a419ff24115042ef8be2ae8_JaffaCakes118.exe

  • Size

    744KB

  • MD5

    c06b57795a419ff24115042ef8be2ae8

  • SHA1

    1e910c65b55e5315157c60af941f8b1b34a70fab

  • SHA256

    febfe7f46caf58cea34fc2a7098daf368911b6c7556a7e1e0f70bea0e6393840

  • SHA512

    1042195e06b85d1ba8904dcddb2fd05255d26372b547d042d7ef9227f350ae7efe81c7902c0be2c56755f3522210092b59ab85a7b4c328f80c5c3b8a539095fa

  • SSDEEP

    12288:jV1a0RlKyUNwKdBZ10uIF+od/wnHiNd8+P7oIAbhSfpGj2//w8JI91SJ7OC2/:jV1awILNN34uvowgGQo/SgQw8e1SJ7OF

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c06b57795a419ff24115042ef8be2ae8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c06b57795a419ff24115042ef8be2ae8_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\61642520.BAT
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2472
  • C:\Windows\las.exe
    C:\Windows\las.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2220

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\61642520.BAT

            Filesize

            218B

            MD5

            444f389c813bf3a58711cece7a6e655b

            SHA1

            bc16d2c9dfbf166da4ccd235c517a376dc8bfcfb

            SHA256

            9d54e93d133100b7f2f89622b68f59b3978dc3e3a630145de056a98090e45387

            SHA512

            24af399120e1fd1967a10cf9b0d84005650be66ebfd3909e4070005e862c03cdd9c0b567159cec2c8227168e4f7aaf0513a65bf7eae6f9ee2027d6891326b9c7

          • C:\Windows\las.exe

            Filesize

            744KB

            MD5

            c06b57795a419ff24115042ef8be2ae8

            SHA1

            1e910c65b55e5315157c60af941f8b1b34a70fab

            SHA256

            febfe7f46caf58cea34fc2a7098daf368911b6c7556a7e1e0f70bea0e6393840

            SHA512

            1042195e06b85d1ba8904dcddb2fd05255d26372b547d042d7ef9227f350ae7efe81c7902c0be2c56755f3522210092b59ab85a7b4c328f80c5c3b8a539095fa

          • memory/1676-5-0x0000000000400000-0x00000000004C3200-memory.dmp

            Filesize

            780KB

          • memory/1676-6-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/1676-18-0x0000000000400000-0x00000000004C3200-memory.dmp

            Filesize

            780KB

          • memory/1676-20-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2056-0-0x0000000000400000-0x00000000004C3200-memory.dmp

            Filesize

            780KB

          • memory/2056-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/2056-16-0x0000000000400000-0x00000000004C3200-memory.dmp

            Filesize

            780KB