Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-09-2024 14:29

General

  • Target

    d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe

  • Size

    134KB

  • MD5

    d491fdea125fa1441c2a08c0ab3b7545

  • SHA1

    8200981affa2c27ea02abcbaa21f3845d06b178d

  • SHA256

    3646ed9c9fefca0d08e9c661a85adff49932d22fdbedf4217d0f6904e21b55df

  • SHA512

    7256af7c4b8dc0f06a5385fe7bc3e607a8962f19e554b91d5947ec80be550fecae30c6be3e7d16edc031f32c7432719048ced0d3c1263e6424a04959c4b8f9c1

  • SSDEEP

    3072:b6rFaxkvDIfkIU+gqBEniJV00ylr/bROHPK6:GrFWkLwhFOnQ00ypbMHP

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d491fdea125fa1441c2a08c0ab3b7545_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\Qconoa.exe
      C:\Windows\Qconoa.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Qconoa.exe

    Filesize

    134KB

    MD5

    d491fdea125fa1441c2a08c0ab3b7545

    SHA1

    8200981affa2c27ea02abcbaa21f3845d06b178d

    SHA256

    3646ed9c9fefca0d08e9c661a85adff49932d22fdbedf4217d0f6904e21b55df

    SHA512

    7256af7c4b8dc0f06a5385fe7bc3e607a8962f19e554b91d5947ec80be550fecae30c6be3e7d16edc031f32c7432719048ced0d3c1263e6424a04959c4b8f9c1

  • C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

    Filesize

    372B

    MD5

    15f15e45ea4235d089ec36d4e00333ea

    SHA1

    d832aa3addfff3adfb4dfe46df7a438deb812d47

    SHA256

    52a0d8b3e81590e724da329ba7d5534cf8dfd30e3747ed46103d7d3fee1b8114

    SHA512

    b8f54357d6c9d2f51cf4f56a6b0775c3238cb9d339c1378db618f902ee459de1a4820f189698ead25bf4e234e9cc88f6f026458a40c197e57ba60c1f3837005e

  • memory/2124-2-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2124-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2124-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2124-9-0x0000000000490000-0x00000000004CB000-memory.dmp

    Filesize

    236KB

  • memory/2124-16305-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2124-51673-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-10-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-11-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-51672-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-12-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-51674-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-51675-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-51677-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-51679-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-51683-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2272-51684-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB