Analysis
- max time kernel
141s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/08/2024, 09:50
General
- Target c07a0d62dbd6c0ba423cc086856b0536_JaffaCakes118.exe
- Size 720KB
- Sample240825-lt7wfaxfre
- SHA256 88c91b9305f90e09a2528defcc55a9768ba668b8ffdac9998dfc6d92e54b1abd
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 4 IoCs
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c07a0d62dbd6c0ba423cc086856b0536_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c07a0d62dbd6c0ba423cc086856b0536_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Hacker.com.cn.exeC:\Windows\Hacker.com.cn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Server.exe
DZRRXA.DAT
memory/1356-91-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/3728-0-0x0000000001000000-0x0000000001122000-memory.dmp
memory/3728-1-0x0000000000690000-0x00000000006E4000-memory.dmp
memory/3728-53-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-52-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-51-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-50-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-49-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-48-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-47-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-46-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-45-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-44-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-56-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-78-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-77-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-76-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-75-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-74-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-73-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-72-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-71-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-70-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-69-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-68-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-67-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-66-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-65-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-64-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-63-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-62-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-61-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-60-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-59-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-57-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-58-0x0000000003120000-0x000000000313B000-memory.dmp
memory/3728-43-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-42-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-41-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-40-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-39-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-38-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-37-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-36-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-35-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-34-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-33-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-32-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-31-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-30-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-29-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-28-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-27-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-26-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-25-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-24-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-23-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-22-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-21-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-20-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-19-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-18-0x0000000003120000-0x0000000003121000-memory.dmp
memory/3728-17-0x0000000003130000-0x0000000003131000-memory.dmp
memory/3728-16-0x0000000003130000-0x0000000003131000-memory.dmp
memory/3728-15-0x0000000003130000-0x0000000003131000-memory.dmp
memory/3728-14-0x0000000003130000-0x0000000003131000-memory.dmp
memory/3728-13-0x0000000003130000-0x0000000003131000-memory.dmp
memory/3728-12-0x0000000003130000-0x0000000003131000-memory.dmp
memory/3728-11-0x0000000003130000-0x0000000003131000-memory.dmp
memory/3728-10-0x0000000000C10000-0x0000000000C11000-memory.dmp
memory/3728-9-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/3728-8-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/3728-7-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/3728-6-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
memory/3728-5-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/3728-4-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/3728-3-0x0000000000C20000-0x0000000000C21000-memory.dmp
memory/3728-2-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/3728-92-0x0000000001000000-0x0000000001122000-memory.dmp
memory/3728-93-0x0000000000690000-0x00000000006E4000-memory.dmp
memory/3872-90-0x0000000000E10000-0x0000000000E22000-memory.dmp
memory/3872-94-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/3872-95-0x0000000000E10000-0x0000000000E22000-memory.dmp
memory/3872-102-0x0000000000400000-0x00000000004CE000-memory.dmp