Analysis

  • max time kernel
    16s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 09:51

General

  • Target

    c07a4a29b484aa8e9796c31341343aa2_JaffaCakes118.exe

  • Size

    34KB

  • MD5

    c07a4a29b484aa8e9796c31341343aa2

  • SHA1

    14f6fe6ffdf0645b5dac73f8aab0e1f820271dec

  • SHA256

    9496905b33fbe997125795f10c41413bc7865d25bda644c8ae8dab71f4429d15

  • SHA512

    59ac0befceeae0330ad35a8d4b7d941ea1f5eaadf97113f5308219b3b93138fdf127d2960c5ddbfc5db5b3eb157933d3cabba80997c8764a41561d13118cc416

  • SSDEEP

    384:oKPxOg0L+AofRHabLwVBqfwhk7WPxZ1pwVtMV2FSxfEMKZKQrh2NSHLxSWjYE0WZ:hPINofRHabcVBH4a1pTYSxkK6hAQVS

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c07a4a29b484aa8e9796c31341343aa2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c07a4a29b484aa8e9796c31341343aa2_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Windows\SysWOW64\Manager.exe
      "C:\Windows\system32\Manager.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\Manager.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2764
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C07A4A~1.EXE > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\drivers\beep.sys

    Filesize

    2KB

    MD5

    2de9ca34e22d737cd652c4a03b286d30

    SHA1

    7cc13e24ba544265590b99f49a4c768d189ff447

    SHA256

    4c8fd01a26646ae36a763dfda0ee663bb92b59f7e09a58ea4441fa4d3aa612b4

    SHA512

    c6f12a4f52177bc128fd9752746ebe1800b412df43b64f861feb229b8ac8f884b8e9b663f3197e69f22c195aff0281b931440e462270764248a1d0173949cb05

  • \Windows\SysWOW64\Manager.exe

    Filesize

    34KB

    MD5

    c07a4a29b484aa8e9796c31341343aa2

    SHA1

    14f6fe6ffdf0645b5dac73f8aab0e1f820271dec

    SHA256

    9496905b33fbe997125795f10c41413bc7865d25bda644c8ae8dab71f4429d15

    SHA512

    59ac0befceeae0330ad35a8d4b7d941ea1f5eaadf97113f5308219b3b93138fdf127d2960c5ddbfc5db5b3eb157933d3cabba80997c8764a41561d13118cc416